Skip to content

Commit b0ca026

Browse files
terrancedejesusterrancedejesus
authored
[New Hunt] Potential Spoofed microsoftonline.com via Fuzzy Match (#4770)
* new hunt for spoofed MSFT domains * added lookback time to ESQL query
1 parent fb03295 commit b0ca026

File tree

4 files changed

+136
-0
lines changed

4 files changed

+136
-0
lines changed

‎hunting/cross-platform/docs/potentially_spoofed_microsoft_authentication_domain.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Potential Spoofed `microsoftonline.com` via Fuzzy Match
2+
3+
---
4+
5+
## Metadata
6+
7+
- **Author:** Elastic
8+
- **Description:** This hunting query identifies potential spoofed domain activity targeting Microsoft online services by detecting fuzzy matches to the domain `microsoftonline.com`. The approach uses approximate string matching (fuzziness) on domain and URL fields, then scores each result by similarity. A static confidence threshold is applied to filter out high-confidence legitimate matches while surfacing potential typosquats and lookalikes.
9+
10+
This technique is useful for identifying phishing campaigns, misconfigured infrastructure, or domain squatting activity targeting Microsoft users and applications. It relies on string similarity scoring and known-good domain exclusions to reduce false positives and focus the hunt on medium- to high-risk spoofed domains.
11+
12+
- **UUID:** `e912f5c6-eed3-11ef-a5d7-6f9f7a1e2e00`
13+
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint), [network_traffic](https://docs.elastic.co/integrations/network_traffic), [system](https://docs.elastic.co/integrations/system), [azure](https://docs.elastic.co/integrations/azure), [o365](https://docs.elastic.co/integrations/o365), [windows](https://docs.elastic.co/integrations/windows)
14+
- **Language:** `[ES|QL]`
15+
- **Source File:** [Potential Spoofed `microsoftonline.com` via Fuzzy Match](../queries/potentially_spoofed_microsoft_authentication_domain.toml)
16+
17+
## Query
18+
19+
```sql
20+
FROM logs-* METADATA _score
21+
| WHERE (
22+
url.domain IS NOT NULL OR
23+
url.original IS NOT NULL OR
24+
destination.domain IS NOT NULL OR
25+
dns.question.name IS NOT NULL
26+
)
27+
| EVAL domain = COALESCE(url.domain, url.original, destination.domain, dns.question.name)::STRING
28+
| WHERE NOT(
29+
domain RLIKE "^(login|portal|api)\\.microsoftonline\\.com$" OR
30+
domain RLIKE ".*\\.onmicrosoft\\.com$" OR
31+
domain == "microsoftonline.com")
32+
| WHERE (
33+
match(url.domain, "microsoftonline.com", { "fuzziness": "AUTO", "max_expansions": 10 }) OR
34+
match(url.original, "microsoftonline.com", { "fuzziness": "AUTO", "max_expansions": 10 }) OR
35+
match(destination.domain, "microsoftonline.com", { "fuzziness": "AUTO", "max_expansions": 10 }) OR
36+
match(dns.question.name, "microsoftonline.com", { "fuzziness": "AUTO", "max_expansions": 10 })
37+
)
38+
| EVAL confidence = CASE(
39+
_score >= 5.999, "low",
40+
_score > 4, "medium",
41+
"high"
42+
)
43+
| WHERE confidence != "low"
44+
OR domain IN ("micsrosoftonline.com", "outlook-office.micsrosoftonline.com")
45+
| SORT _score DESC
46+
| KEEP @timestamp, source.ip, user.id, domain, _score, confidence
47+
```
48+
49+
## Notes
50+
51+
- Investigate domains that resemble `microsoftonline.com` but have slight character substitutions (e.g., `micros0ftonline.com`, `m1crosoftonline.com`).
52+
- Fuzzy matching assigns a `_score` based on edit distance. Higher scores mean a closer match to the legitimate domain.
53+
- Only medium- and high-confidence results are surfaced by excluding `_score >= 6`, which usually represents exact or near-exact matches.
54+
- Legitimate Microsoft domains like `login.microsoftonline.com`, `portal.microsoftonline.com`, and tenant domains ending in `.onmicrosoft.com` are excluded from results to reduce noise.
55+
- Results are ranked by `_score DESC` and tagged with a confidence level: `low`, `medium`, or `high`.
56+
- This query is best used interactively during hunts and may require tuning for specific environments with high Microsoft traffic.
57+
58+
## MITRE ATT&CK Techniques
59+
60+
- [T1566.002](https://attack.mitre.org/techniques/T1566/002)
61+
- [T1583.001](https://attack.mitre.org/techniques/T1583/001)
62+
63+
## References
64+
65+
- https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/
66+
67+
## License
68+
69+
- `Elastic License v2`

‎hunting/cross-platform/queries/potentially_spoofed_microsoft_authentication_domain.toml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
[hunt]
2+
author = "Elastic"
3+
description = """
4+
This hunting query identifies potential spoofed domain activity targeting Microsoft online services by detecting fuzzy matches to the domain `microsoftonline.com`. The approach uses approximate string matching (fuzziness) on domain and URL fields, then scores each result by similarity. A static confidence threshold is applied to filter out high-confidence legitimate matches while surfacing potential typosquats and lookalikes.
5+
6+
This technique is useful for identifying phishing campaigns, misconfigured infrastructure, or domain squatting activity targeting Microsoft users and applications. It relies on string similarity scoring and known-good domain exclusions to reduce false positives and focus the hunt on medium- to high-risk spoofed domains.
7+
"""
8+
integration = ["endpoint", "network_traffic", "system", "azure", "o365", "windows"]
9+
uuid = "e912f5c6-eed3-11ef-a5d7-6f9f7a1e2e00"
10+
name = "Potential Spoofed `microsoftonline.com` via Fuzzy Match"
11+
language = ["ES|QL"]
12+
license = "Elastic License v2"
13+
notes = [
14+
"Investigate domains that resemble `microsoftonline.com` but have slight character substitutions (e.g., `micros0ftonline.com`, `m1crosoftonline.com`).",
15+
"Fuzzy matching assigns a `_score` based on edit distance. Higher scores mean a closer match to the legitimate domain.",
16+
"Only medium- and high-confidence results are surfaced by excluding `_score >= 6`, which usually represents exact or near-exact matches.",
17+
"Legitimate Microsoft domains like `login.microsoftonline.com`, `portal.microsoftonline.com`, and tenant domains ending in `.onmicrosoft.com` are excluded from results to reduce noise.",
18+
"Results are ranked by `_score DESC` and tagged with a confidence level: `low`, `medium`, or `high`.",
19+
"This query is best used interactively during hunts and may require tuning for specific environments with high Microsoft traffic."
20+
]
21+
mitre = ["T1566.002", "T1583.001"]
22+
query = [
23+
'''
24+
FROM logs-* METADATA _score
25+
| WHERE @timestamp > now() - 30 day
26+
| WHERE (
27+
url.domain IS NOT NULL OR
28+
url.original IS NOT NULL OR
29+
destination.domain IS NOT NULL OR
30+
dns.question.name IS NOT NULL
31+
)
32+
| EVAL domain = COALESCE(url.domain, url.original, destination.domain, dns.question.name)::STRING
33+
| WHERE NOT(
34+
domain RLIKE "^(login|portal|api)\\.microsoftonline\\.com$" OR
35+
domain RLIKE ".*\\.onmicrosoft\\.com$" OR
36+
domain == "microsoftonline.com")
37+
| WHERE (
38+
match(url.domain, "microsoftonline.com", { "fuzziness": "AUTO", "max_expansions": 10 }) OR
39+
match(url.original, "microsoftonline.com", { "fuzziness": "AUTO", "max_expansions": 10 }) OR
40+
match(destination.domain, "microsoftonline.com", { "fuzziness": "AUTO", "max_expansions": 10 }) OR
41+
match(dns.question.name, "microsoftonline.com", { "fuzziness": "AUTO", "max_expansions": 10 })
42+
)
43+
| EVAL confidence = CASE(
44+
_score >= 5.999, "low",
45+
_score > 4, "medium",
46+
"high"
47+
)
48+
| WHERE confidence != "low"
49+
OR domain IN ("micsrosoftonline.com", "outlook-office.micsrosoftonline.com")
50+
| SORT _score DESC
51+
| KEEP @timestamp, source.ip, user.id, domain, _score, confidence
52+
'''
53+
]
54+
references = [
55+
"https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/"
56+
]

‎hunting/index.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,10 @@ Here are the queries currently available:
4141
- [Microsoft Entra Infrequent Suspicious OData Client Requests](./azure/docs/entra_suspicious_odata_client_requests.md) (ES|QL)
4242

4343

44+
## cross-platform
45+
- [Potential Spoofed `microsoftonline.com` via Fuzzy Match](./cross-platform/docs/potentially_spoofed_microsoft_authentication_domain.md) (ES|QL)
46+
47+
4448
## linux
4549
- [Defense Evasion via Capitalized Process Execution](./linux/docs/defense_evasion_via_capitalized_process_execution.md) (ES|QL)
4650
- [Drivers Load with Low Occurrence Frequency](./linux/docs/persistence_via_driver_load_with_low_occurrence_frequency.md) (ES|QL)

‎hunting/index.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -771,3 +771,10 @@ azure:
771771
path: ./azure/queries/entra_rare_actions_by_service_principal.toml
772772
mitre:
773773
- T1098.001
774+
cross-platform:
775+
e912f5c6-eed3-11ef-a5d7-6f9f7a1e2e00:
776+
name: Potential Spoofed `microsoftonline.com` via Fuzzy Match
777+
path: ./cross-platform/queries/potentially_spoofed_microsoft_authentication_domain.toml
778+
mitre:
779+
- T1566.002
780+
- T1583.001

0 commit comments

Comments
 (0)