APT28 PRISMEX — Operation Neusploit (CVE-2026-21509)

Looks for: Word/Office spawning shells/loaders/LOLBins (CVE-2026-21509 exploit outcome). Accomplishes: catches the RTF-exploit chain. FP: some macro-enabled docs — flag non-Office children + RTF context.

// HUNT: APT28 Office RTF exploit lineage (CVE-2026-21509)
// MITRE: T1203, T1566.001 | CONF: high  FP: low-med  COST: low
// FP NOTES: macro-enabled docs; flag winword spawning shells/loaders, esp. from .rtf
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(winword|excel|powerpnt|wordview)\.exe$/i
| FileName=/^(cmd|powershell|pwsh|mshta|wscript|cscript|rundll32|regsvr32|msiexec|certutil|curl)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: a PE written to %TEMP%/%AppData% by an Office-spawned process (PixyNetLoader / MiniDoor drop). FP: correlate with Q1 on the same host.

// HUNT: APT28 dropper writing PixyNetLoader/MiniDoor to a user path
// MITRE: T1105, T1574 | CONF: medium  FP: medium  COST: low
// TUNING: correlate to Q1 (Office-spawned); flag PE/dll writes to %TEMP%/%AppData%
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| ContextBaseFileName=/^(winword|cmd|powershell|mshta|rundll32)\.exe$/i
| TargetFileName=/\\(Temp|AppData)\\.+\.(exe|dll)$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData], limit=200)

Looks for: Outlook VBA / macro-on-boot registry changes (the NotDoor/MiniDoor persistence). Accomplishes: the email-stealer install. FP: sanctioned Outlook macros — rare; verify.

// HUNT: MiniDoor / NotDoor Outlook email-stealer persistence
// MITRE: T1137, T1114 | CONF: med-high  FP: low-med  COST: low
// TUNING: Outlook VBA is rare in most orgs; alert on VbaProject.OTM / LoadMacroProviderOnBoot
#event_simpleName=/AsepValueUpdate|RegGenericValueUpdate|PeFileWritten/
| (RegObjectName=/\\Office\\.+\\Outlook\\.+(LoadMacroProviderOnBoot|Security\\Level)/i
   or TargetFileName=/\\Outlook\\VbaProject\.OTM$/i)
| table([@timestamp, ComputerName, UserName, RegObjectName, RegStringValue, TargetFileName], limit=200)

Looks for: a user-path binary spawning a .NET-host process or known Covenant Grunt behavior (rundll32/regsvr32 loading a temp DLL; GruntStager strings). FP: correlate with Q1/Q2; Covenant is generic — tune.

// HUNT: PixyNetLoader -> Covenant Grunt
// MITRE: T1574, T1071.001 | CONF: medium  FP: medium  COST: low
// TUNING: Covenant is a public framework; correlate to Q1/Q2 + tune GruntStager indicators
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (CommandLine=/(GruntStager|Grunt\.exe|Covenant|csc\.exe.+\\Temp\\.+\.cs)/i
   or (FileName=/^(rundll32|regsvr32)\.exe$/i and CommandLine=/\\(Temp|AppData)\\.+\.dll/i))
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: DNS/connections to filen.io (staging/exfil) or Covenant C2 from a user-path binary. FP: filen.io is a legit service — flag from a non-sanctioned process; correlate with Q4.

// HUNT: APT28 C2 / exfil (filen.io staging / Covenant)
// MITRE: T1071.001, T1567.002 | CONF: medium  FP: medium  COST: med
// TUNING: filen.io is legitimate; flag from non-sanctioned processes; correlate to Q4
#event_simpleName=DnsRequest
| DomainName=/(^|\.)filen\.io$/i
| ContextBaseFileName!=/^(filen|filen-desktop)\.exe$/i
| table([@timestamp, ComputerName, ContextBaseFileName, DomainName], limit=200)

Looks for: Office process versions predating the 26 Jan 2026 OOB fix. Accomplishes: exposure inventory — the patch is the fix. FP: low; cross-check build numbers per channel.

// HUNT: vulnerable Office build inventory (CVE-2026-21509)
// MITRE: T1203 | CONF: medium  FP: low  COST: low
// TUNING: map FileVersion to the 26 Jan 2026 OOB patched builds per Office channel
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^winword\.exe$/i
| groupBy([ComputerName, FileVersion], function=count())
| table([ComputerName, FileVersion, _count], limit=200)