Dropping payload via certutil

Description

BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader. This query hunts for an attacker-created copy of certutil.exe, a legitimate process, which the macro uses to download BazaLoader.

Query · kql

DeviceFileEvents
| where InitiatingProcessFileName !~ "certutil.exe"
| where InitiatingProcessFileName !~ "cmd.exe"
| where InitiatingProcessCommandLine has_all("-urlcache", "split", "http")
Raw source Dropping payload via certutil · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: f5ff5b00-a90e-40b8-b241-9427a8ec5189
name: Dropping payload via certutil
description: |
  BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader.
  This query hunts for an attacker-created copy of certutil.exe, a legitimate process, which the macro uses to download BazaLoader.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Initial access
- Defense evasion
query: |
  DeviceFileEvents
  | where InitiatingProcessFileName !~ "certutil.exe"
  | where InitiatingProcessFileName !~ "cmd.exe"
  | where InitiatingProcessCommandLine has_all("-urlcache", "split", "http")

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.