snip3-aviation-targeting-emails

Description

Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques. The following query looks for keywords observed in emails involved in a Snip3-associated campaign in April and May of 2021. The emails often have an aviation theme, and the campaign primarily targets organizations involved in travel or aviation. Note that keywords may change overtime. These emails were used to send malicious legitimate hosting provider links that redirected to VBS documents hosting loaders. The loaders initiate RevengeRAT or AsyncRAT downloads that eventually establish persistence on targets and exfiltrate data.

Query · kql

let SubjectTerms = 
pack_array("Cargo Charter","Airbus Meeting","WorldWide Symposium","Airbus Family","Flight Request",
"Advice from NetJets","May/ACMI","AIRCRAFT PRESENTATION","Airworthiness", "Air Quote", "RFQ #9B17811");
EmailEvents
| where SenderDisplayName has_any(SubjectTerms)
// Optional Sender restriction for organizations with high FP
// where SenderIpv4 == "192.145.239.18"  
| where EmailDirection == "Inbound"  
| join EmailUrlInfo on $left.NetworkMessageId == $right.NetworkMessageId
| where Url has_any("drive.google.com","1drv.ms","onedrive.live.com")
| take 100
Raw source snip3-aviation-targeting-emails · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: cfffcab3-d4c7-4aad-b80d-5f415ef5ac66
name: snip3-aviation-targeting-emails
description: |
  Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques.
  The following query looks for keywords observed in emails involved in a Snip3-associated campaign in April and May of 2021. The emails often have an aviation theme, and the campaign primarily targets organizations involved in travel or  aviation. Note that keywords may change overtime. These emails were used to send malicious legitimate hosting provider links that redirected to VBS documents hosting loaders. The loaders initiate RevengeRAT or AsyncRAT downloads that eventually establish persistence on targets and exfiltrate data.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailUrlInfo
tactics:
- Initial access
query: |
  let SubjectTerms = 
  pack_array("Cargo Charter","Airbus Meeting","WorldWide Symposium","Airbus Family","Flight Request",
  "Advice from NetJets","May/ACMI","AIRCRAFT PRESENTATION","Airworthiness", "Air Quote", "RFQ #9B17811");
  EmailEvents
  | where SenderDisplayName has_any(SubjectTerms)
  // Optional Sender restriction for organizations with high FP
  // where SenderIpv4 == "192.145.239.18"  
  | where EmailDirection == "Inbound"  
  | join EmailUrlInfo on $left.NetworkMessageId == $right.NetworkMessageId
  | where Url has_any("drive.google.com","1drv.ms","onedrive.live.com")
  | take 100

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.