CaptiveCrunch — Storm-2945 / Midnight Blizzard captive-portal AiTM

Storm-2945, assessed by Microsoft as a sub-cluster of Midnight Blizzard (APT29 / Cozy Bear, attributed to Russia's SVR), has since early May 2026 been manipulating DNS and HTTP traffic on hospitality-sector captive-portal networks worldwide. The attacker objective is not the hotel: it is the corporate traveller's laptop and, through it, the traveller's Microsoft 365 tenant. Venue Wi-Fi is simply the position from which an adversary-in-the-middle can rewrite what a managed endpoint sees the moment it joins a network.

The delivery trick is what makes this campaign efficient. Rather than waiting for a user to browse somewhere, the actor intercepts the automated connectivity check that Windows and browsers issue on joining a network (NCSI), and answers it with a ClickFix-style page impersonating Windows Update, a browser update, DirectX or a human-verification check. The user is instructed to copy a command and run it themselves, which sidesteps both the download-mark-of-the-web path and any "don't click attachments" training. Two payloads follow: CornFlake, a Go Windows RAT that installs as a service named svchost32 with the display name "Cloud Sync Service" and re-installs its own persistence via a watchdog, and ChocoShell, an in-memory PowerShell infostealer that bypasses AMSI and UAC and harvests browser cookies, saved passwords, Wi-Fi keys and Microsoft 365 / Entra tokens. FruitStone is the operator-side web C2 panel — it never touches a victim endpoint, so no endpoint detection is written for it here.

Since 2026-07-16 a portion of the landing pages skip malware entirely and run Entra device code phishing: the user is sent to the genuine Microsoft sign-in page and told to type an actor-supplied code, authenticating the attacker's session and enabling attacker device registration plus Microsoft Graph collection. That branch leaves no endpoint artefact at all.

Highest-value defensive angle: the endpoint half of this campaign is loud and cheap to catch — a non-Microsoft binary called svchost32.exe running out of %APPDATA% and registering a service is close to a zero-false-positive signal (Q1–Q3). The identity half is the one that will actually hurt you, because it survives reimaging the laptop. Block or scope the device code flow, and treat any device-code sign-in from a traveller as an incident until proven otherwise.

Defender priority: Deploy Q1, Q2, Q3 and Q5 today — they are high-confidence and low-noise. Then, before the next travel week, block the Entra device code flow via Conditional Access (or scope it to a named app allowlist) and hunt Q13 across the last 90 days. An endpoint you reimage is recoverable; a refresh token and an attacker-registered device are not, until you revoke them.

Decisions taken during research

• Every atomic indicator in this pack comes from one source. Microsoft is the only publisher of the hashes, domains and IPs; the four corroborating sources carry the narrative but print no indicators. The two-independent-source bar for a blocking action is therefore not met, so nothing ships at action=prevent / severity=critical. All atomic rows are detect / high. Promote to prevent only after a second source or an internal confirmed hit.
• FruitStone gets no endpoint detection. It is the operator's browser-based C2 console. Writing endpoint logic for it would generate a coverage claim the telemetry cannot support.
• Name collision, deliberately noted. This campaign's CornFlake is a Golang Windows RAT. It is not the Interlock-associated CORNFLAKE loader covered elsewhere in the library — different family, different infrastructure, no shared indicators. Do not merge the two IOC sets or reuse the other pack's detections here.
• Prompt-injection screen: clean. All five fetched pages were checked for text attempting to direct the research process (instructions to run commands, to fetch a further URL for "the real IOCs", or claims of prior authorisation). None was present in any source. No source was disqualified.
• Perishability. Captive-portal infrastructure and C2 IPs rotate fast; Microsoft describes proxy relays with health checks and rotation built into the operator panel. Treat the six IPs as 90-day indicators and the behavioural queries as the durable coverage.

Attack chain

Hunt hypotheses (ordered by fidelity)

Attack-chain steps with no mappable Falcon telemetry

• Step 1 — venue-side DNS/HTTP manipulation. Happens on infrastructure you do not own or instrument. There is no sensor event for "the captive portal lied to me". Compensate with the travel-correlation native hunt in §7 and with hardening (§12) rather than pretending detection coverage exists.
• Step 2 — NCSI interception. The Falcon sensor does not surface the connectivity-check request as a distinct event, so the "file created within 2 minutes of an NCSI probe" query Microsoft published for Defender has no direct CQL equivalent. Q8 approximates the same moment from the process side.
• Android APK variant. Out of scope for Windows sensor telemetry; route to your MTD/MDM stack.

Single-source caveat. Every atomic indicator below is published by Microsoft Threat Intelligence only. No second independent source reprints them. They ship as detect, never prevent, and the behavioural signals in §10 are the durable half of this pack.

The identity half of CaptiveCrunch is invisible to the endpoint sensor. These run in the Entra / M365 admin surfaces and are the checks that matter most after a travel period.

N1 — Device code sign-ins (Entra sign-in logs)

Filter Sign-in logs → Authentication requirements / Protocol for the device code flow over the last 90 days. Any result for a user who has never used a CLI or kiosk enrolment is suspicious. Cross-reference the source IP against the six published C2 addresses and against the traveller's expected geography. Microsoft's own alert names to watch for: "Anomalous OAuth device code authentication activity" and "Suspicious Azure authentication through possible device code phishing".

N2 — New Entra device registrations

Entra ID → Devices → All devices, sorted by registration date. Successful device-code phishing is followed by the actor registering their own device to make the session durable. Correlate every device registered during or shortly after a travel window with the owning user's known hardware. Also review Audit logs for Add registered device and Add device events.

N3 — MFA / passkey registration from unexpected locations

Audit logs → Activity: "User registered security info". An actor with a live session will try to add their own authentication method. Filter to registrations occurring outside your trusted named locations.

N4 — Post-token-theft mailbox and Graph collection

Unified Audit Log: MailItemsAccessed with a client app of Graph or an unfamiliar app ID, plus Add delegated permission grant and Consent to application in the Entra audit log. Midnight Blizzard's established pattern is Graph-based mail exfiltration once a session is held.

N5 — Travel correlation (the pivot that ties the two halves together)

Build a list of users who travelled in the affected window (early May 2026 onward). For each, check: any device-code sign-in, any new device registration, any interactive sign-in from a hospitality ASN, and any Falcon detection from §8 on their assigned endpoint. A hit on either side for a traveller warrants a full session revocation, not a triage note.

N6 — Conditional Access posture review

Confirm whether a policy blocking or scoping the device code flow exists at all. If it does not, this hunt has no compensating control behind it and §12 Immediate item 2 becomes the priority action.

No query below carries an in-query time filter. Set the window with the console time picker; each query records its intended lookback as a // LOOKBACK: comment. An @timestamp comparison against now() is rejected by the CQL parser on line 1, which silently kills the whole query.

// HUNT: CornFlake RAT execution (svchost32 masquerade)
// MITRE: T1036.005, T1543.003 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: none expected -- svchost32 is not a Microsoft binary name
// LOOKBACK: 90d (set in the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^svchost32(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])
| sort(@timestamp, order=desc)

// HUNT: CornFlake service registration ("Cloud Sync Service")
// MITRE: T1543.003 | CONF: high  FP: low  COST: low
// REQUIRES: CreateService
// NOTE: ServiceDisplayName / ServiceImagePath population varies by sensor version
//       -- (!) validate in tenant against a known-good service install first
// FALSE POSITIVES: none expected for this exact display-name string
// LOOKBACK: 90d (set in the console time picker)
#event_simpleName=/^CreateService$/
| ServiceDisplayName=/^Cloud\s+Sync\s+Service$/i or ServiceImagePath=/svchost32/i
| table([@timestamp, aid, ComputerName, UserName, ServiceName, ServiceDisplayName, ServiceImagePath])
| sort(@timestamp, order=desc)

// HUNT: CornFlake Run-key / service-key persistence
// MITRE: T1547.001, T1543.003 | CONF: high  FP: low  COST: low
// REQUIRES: AsepValueUpdate, RegGenericValueUpdate
// FALSE POSITIVES: none expected -- the string svchost32 is campaign-specific
// LOOKBACK: 90d (set in the console time picker)
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegStringValue=/svchost32/i or RegObjectName=/\\Services\\svchost32/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])
| sort(@timestamp, order=desc)

// HUNT: Scheduled task registered against a user-writable AppData executable
// MITRE: T1053.005 | CONF: medium  FP: medium  COST: low
// REQUIRES: ScheduledTaskRegistered
// FALSE POSITIVES: Chrome/Edge/Teams/Zoom/Slack/Dropbox per-user updaters
// TUNING: exclude your approved per-user updaters by task executable basename,
//         e.g. TaskExecutable!=/(GoogleUpdate|MicrosoftEdgeUpdate|Update\.exe|Teams\.exe|Zoom)/i
//         then stack the survivors by count -- CornFlake will be a rare singleton
// LOOKBACK: 90d (set in the console time picker)
#event_simpleName=/^ScheduledTaskRegistered$/
| TaskExecutable=/\\AppData\\(Roaming|Local)\\/i
| TaskExecutable!=/(GoogleUpdate|MicrosoftEdgeUpdate|OneDrive|Teams|Zoom|Slack|Dropbox)/i
| groupBy([TaskExecutable, TaskName], function=[count(as=Hosts), collect([ComputerName, UserName, TaskAuthor])], limit=500)
| sort(Hosts, order=asc, limit=200)

// HUNT: CornFlake / ChocoShell known SHA256 execution or write
// MITRE: T1204 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2, PeFileWritten, NewExecutableWritten
// FALSE POSITIVES: none -- exact hash match
// LOOKBACK: 90d (set in the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| SHA256HashData=/^(918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593|be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c)$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, TargetFileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc)

// HUNT: CaptiveCrunch doppelganger domain resolution
// MITRE: T1566.002, T1071.001 | CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest / SuspiciousDnsRequest
// FALSE POSITIVES: TI-scanner or sandbox hosts deliberately re-resolving IOCs
// LOOKBACK: 90d (set in the console time picker)
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/^(.*\.)?(ms365-device|ms365-live|m365-owa|owa-ms365)\.com$/i
| table([@timestamp, aid, ComputerName, DomainName, ContextProcessId_decimal])
| sort(@timestamp, order=desc)

// HUNT: CaptiveCrunch C2 IP egress
// MITRE: T1071.001, T1041 | CONF: high  FP: low  COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: TI-proxy or scanner infrastructure re-checking indicators
// LOOKBACK: 90d (set in the console time picker)
#event_simpleName=/^NetworkConnectIP4$/
| in(RemoteAddressIP4, values=["31.57.243.154", "38.146.28.75", "38.146.28.132", "104.194.159.150", "107.189.26.194", "213.145.86.112"])
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, Protocol_decimal])
| sort(@timestamp, order=desc)

// HUNT: ClickFix paste-and-run -- browser/Run-dialog parented interpreter
// MITRE: T1204.004, T1059.001, T1059.003 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: developer workstations, IT self-service / RMM web consoles,
//                  browser-launched installer helpers
// TUNING: exclude your engineering OU or known dev hosts by ComputerName pattern,
//         and exclude your RMM/self-service agent by ParentBaseFileName before
//         promoting this to an alert. Triage newest-first; a real ClickFix hit is
//         followed within seconds by a write under %APPDATA% (pivot to Q1).
// LOOKBACK: 30d (set in the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(msedge|chrome|firefox|brave|opera|iexplore|explorer)\.exe$/i
| FileName=/^(powershell|pwsh|cmd|mshta|wscript|cscript|curl|certutil|conhost)\.exe$/i
| CommandLine=/(-nop\b|-noprofile\b|-w\s+hidden|-windowstyle\s+hidden|-enc\b|-encodedcommand\b|iex\b|invoke-expression|invoke-webrequest|downloadstring|frombase64string|scriptblock)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Wi-Fi profile key dump (netsh wlan show profile key=clear)
// MITRE: T1555 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: helpdesk diagnostics, MDM/RMM wireless inventory scripts
// TUNING: exclude your RMM agent and support tooling by ParentBaseFileName
//         (e.g. ParentBaseFileName!=/(ninjarmm|screenconnect|intune|ccmexec)/i)
//         -- a genuine ChocoShell hit is parented by powershell.exe with no
//         management agent anywhere in the tree
// LOOKBACK: 90d (set in the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^netsh\.exe$/i
| CommandLine=/wlan\s+show\s+profile/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, GrandparentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Chromium relaunch with remote debugging port (CDP cookie extraction)
// MITRE: T1539, T1555.003 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: web developers, Selenium/Playwright/Puppeteer test automation
// TUNING: exclude engineering hosts and CI runners by ComputerName; a malicious
//         relaunch is parented by powershell.exe or svchost32.exe rather than by
//         a shell, an IDE, or a node.exe test harness -- filter on
//         ParentBaseFileName before alerting
// LOOKBACK: 90d (set in the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(chrome|msedge|brave|opera|vivaldi)\.exe$/i
| CommandLine=/--remote-debugging-(port|pipe)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: UAC bypass via HKCU windir / COM DelegateExecute / Folder shell hijack
// MITRE: T1548.002, T1112 | CONF: medium  FP: medium  COST: low
// REQUIRES: AsepValueUpdate, RegGenericValueUpdate, RegSystemConfigValueUpdate
// FALSE POSITIVES: installers registering file associations under HKCU Classes
// TUNING: exclude msiexec.exe and your software-deployment agent as the writing
//         process; a HKCU\Environment "windir" write has essentially no benign
//         use -- treat that value alone as high severity and the Classes writes
//         as the lower-confidence tier
// LOOKBACK: 90d (set in the console time picker)
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate|RegSystemConfigValueUpdate)$/
| RegValueName=/^(windir|DelegateExecute)$/i or RegObjectName=/\\Classes\\(Folder|ms-settings|mscfile|Applications\\wsreset)\\/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])
| sort(@timestamp, order=desc)

// HUNT: browser credential store / Entra Token Broker cache targeting
// MITRE: T1555.003, T1528, T1539 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: profile migration tools, endpoint backup agents, browser
//                  import wizards run by the user
// TUNING: exclude your backup/migration agent by FileName and ParentBaseFileName;
//         the malicious pattern is powershell.exe touching several of these paths
//         in one command line -- a single path reference alone is weak evidence
// LOOKBACK: 90d (set in the console time picker)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(tbres|TokenBroker|cookies\.sqlite|logins\.json|key4\.db|Login\s?Data|Local\s+State|Web\s+Data)/i
| FileName!=/^(msedge|chrome|firefox|brave|opera|vivaldi)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Entra device code authentication anomaly (CaptiveCrunch device-code phish)
// MITRE: T1528, T1550.001, T1098.005 | CONF: medium  FP: medium  COST: medium
// REQUIRES: Entra sign-in logs ingested to NG-SIEM (azure_signinlogs)
// NOTE: (!) validate in tenant -- IdP field names are parser-prefixed and vary
// FALSE POSITIVES: Azure CLI / azd, Intune or Autopilot enrolment, kiosk and IoT
//                  provisioning, developer sign-ins on headless hosts
// TUNING: exclude your sanctioned device-code client app IDs and automation
//         service accounts, then review what remains user-by-user. Any hit for a
//         user who travelled since 2026-05-01 is an incident until disproven.
// LOOKBACK: 90d (set in the console time picker)
#repo=azure_signinlogs
| authenticationProtocol=/deviceCode/i
| groupBy([userPrincipalName, ipAddress, appDisplayName, conditionalAccessStatus], function=[count(as=SignIns), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| sort(SignIns, order=desc, limit=200)

Promote only the low-FP queries to blocking IOAs. Q4, Q8, Q9, Q10, Q11, Q12 and Q13 stay hunt-only until baselined in your environment.

Deployment path: Falcon console → Endpoint security → Custom IOA rule groups. Stage every rule in Monitor for one full business cycle (including a travel week) before switching to Block, then confirm the rule group is assigned to the prevention policy that actually covers your travel fleet — laptops are frequently in a looser policy than desktops, which is precisely the population this campaign targets.

Playbook 1 — Block the Entra device code flow (Conditional Access)

Prerequisites: Entra ID P1 or higher; Conditional Access Administrator or Security Administrator role; a break-glass account excluded from all CA policies; Microsoft.Graph PowerShell module installed.
Reboot required: No.
Rollback: Set the policy state back to disabled (step 4 below), or delete the policy entirely. No client-side change is made, so rollback is immediate and total.

1. Inventory first -- find who legitimately uses the flow before you block it.
   Entra portal -> Sign-in logs -> Add filter -> Authentication protocol
   -> Device code. Export 90 days. Anything you find here becomes either an
   exclusion or a conversation with that team.

2. Create the policy in report-only mode (Graph PowerShell):

   Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"

   $params = @{
     displayName = "Block device code flow"
     state       = "enabledForReportingButNotEnforced"
     conditions  = @{
       users        = @{
         includeUsers  = @("All")
         excludeGroups = @("REPLACE_WITH_BREAKGLASS_GROUP_OBJECTID")
       }
       applications = @{ includeApplications = @("All") }
       authenticationFlows = @{ transferMethods = "deviceCodeFlow" }
     }
     grantControls = @{ operator = "OR"; builtInControls = @("block") }
   }
   New-MgIdentityConditionalAccessPolicy -BodyParameter $params

3. Leave it in report-only for 7 days. Review Sign-in logs -> Report-only tab
   for any impacted sign-in. Add exclusions for genuine device-code apps
   (Azure CLI service accounts, kiosk enrolment) as named app exclusions --
   NOT as user exclusions, which are far broader than intended.

4. Enforce, or roll back:
   $id = (Get-MgIdentityConditionalAccessPolicy |
          Where-Object DisplayName -eq "Block device code flow").Id
   # enforce:
   Update-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $id `
     -State "enabled"
   # ROLLBACK -- returns the tenant to its previous behaviour immediately:
   Update-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $id `
     -State "disabled"

5. Verify: attempt a device-code sign-in with a test account. It must fail with
   a Conditional Access block, and the block must appear in Sign-in logs.

Playbook 2 — CornFlake host triage and eradication

Prerequisites: Local administrator on the target host; the host network-contained in Falcon before you begin (the watchdog re-creates persistence, and the RAT has a live remote shell); PowerShell 5.1+ running elevated.
Reboot required: Yes — after step 5, to confirm nothing re-spawns.
Rollback: Not applicable in the usual sense; these steps remove attacker-created objects only. Before deleting anything, run step 1 and preserve its output plus a copy of the payload and sync.dat as evidence. If a service or task turns out to be legitimate in your environment, re-create it from your configuration baseline. The recommended end state is reimage, not repair — the watchdog and the localhost control API mean partial removal is not reliably verifiable.

1. COLLECT BEFORE YOU DELETE (host already contained in Falcon):

   $out = "$env:TEMP\cc-triage-$(Get-Date -f yyyyMMddHHmmss).txt"
   Get-Service -Name "svchost32" -ErrorAction SilentlyContinue |
     Format-List * | Out-File $out -Append
   Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\svchost32" `
     -ErrorAction SilentlyContinue | Out-File $out -Append
   Get-ChildItem "$env:APPDATA\svchost32" -Force -ErrorAction SilentlyContinue |
     Out-File $out -Append
   Get-ScheduledTask | Where-Object {
     $_.Actions.Execute -like "*AppData*" } |
     Select-Object TaskName, TaskPath, @{n='Exec';e={$_.Actions.Execute}} |
     Out-File $out -Append
   Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
     "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" |
     Out-File $out -Append
   Get-ItemProperty "HKCU:\Environment" -Name windir -ErrorAction SilentlyContinue |
     Out-File $out -Append

2. Copy $out, the payload and sync.dat off the host to evidence storage.

3. Stop and delete the service:
   Stop-Service -Name "svchost32" -Force -ErrorAction SilentlyContinue
   sc.exe delete "svchost32"

4. Remove the scheduled tasks identified in step 1 (review each by name first):
   # Unregister-ScheduledTask -TaskName "REPLACE_WITH_TASKNAME" -Confirm:$false

5. Remove the payload directory and the UAC-bypass key:
   Remove-Item "$env:APPDATA\svchost32" -Recurse -Force -ErrorAction SilentlyContinue
   Remove-ItemProperty "HKCU:\Environment" -Name windir -ErrorAction SilentlyContinue

6. Reboot, then re-run step 1. If ANY artefact has returned, the watchdog is
   still resident: stop repairing and reimage.

7. Regardless of outcome, treat the identity as compromised -- go to Playbook 3.

Playbook 3 — Identity containment for an affected traveller

Prerequisites: Privileged Authentication Administrator (for credential reset) and Cloud Device Administrator (to remove devices); Microsoft.Graph PowerShell module; the user reachable through an out-of-band channel you trust — not their possibly-compromised mailbox or Teams.
Reboot required: No.
Rollback: None required, and none should be attempted — every action here is a deliberate credential invalidation. The user re-authenticates and re-enrols as part of normal recovery. Removing a device that turns out to be the user's own is corrected by having them re-register it through the standard join process.

Connect-MgGraph -Scopes "User.ReadWrite.All","Device.ReadWrite.All",
                        "AuditLog.Read.All","Directory.AccessAsUser.All"

$upn = "REPLACE_WITH_USER_UPN"

1. Revoke every refresh token and active session:
   Revoke-MgUserSignInSession -UserId $upn

2. Force a credential reset (do this via your standard process, in person or
   over a verified out-of-band channel -- NOT by emailing the user).

3. List devices registered to the user and check every one against known
   hardware. Anything unrecognised is the attacker's:
   Get-MgUserRegisteredDevice -UserId $upn |
     Select-Object Id, DisplayName, AdditionalProperties

   # Remove an attacker-registered device:
   # Remove-MgDevice -DeviceId "REPLACE_WITH_DEVICE_OBJECTID"

4. Re-enrol MFA from scratch. Delete existing methods and have the user
   register a passkey in person.

5. Review the mailbox for actor persistence:
   Get-InboxRule -Mailbox $upn | Select-Object Name, Enabled, ForwardTo,
     RedirectTo, DeleteMessage
   Get-Mailbox $upn | Select-Object ForwardingSmtpAddress,
     DeliverToMailboxAndForward
   Get-MailboxPermission -Identity $upn | Where-Object { -not $_.IsInherited }

6. Check for OAuth consent granted during the compromise window:
   Get-MgUserOauth2PermissionGrant -UserId $upn |
     Select-Object ClientId, Scope, ConsentType

7. Only after 1-6 are complete, release the endpoint from containment or issue
   the reimaged replacement.

Playbook 4 — PowerShell Constrained Language Mode on the travel fleet

Prerequisites: AppLocker or WDAC already in audit mode on a pilot ring; an inventory of business-critical PowerShell that runs on user endpoints (CLM breaks .NET reflection, Add-Type, and COM instantiation); Intune or GPO delivery.
Reboot required: No, but users must start a new PowerShell session for the mode to apply.
Rollback: Remove the AppLocker/WDAC policy (or return it to audit mode) and delete the __PSLockdownPolicy environment variable if it was used for the pilot; the next new session returns to FullLanguage. Keep the pilot ring small precisely so this rollback stays cheap.

1. Baseline first -- enable script block logging fleet-wide and collect 14 days:
   GPO: Computer Configuration -> Administrative Templates -> Windows Components
        -> Windows PowerShell -> "Turn on PowerShell Script Block Logging" = Enabled
   Review Event ID 4104 for reflection, Add-Type and COM use in YOUR scripts.

2. Pilot ring: apply an AppLocker policy in ENFORCE for Script rules only.
   CLM is a side effect of AppLocker/WDAC enforcement -- this is the supported
   route. Do not set __PSLockdownPolicy as a production mechanism; it is a
   pilot/testing aid only and is trivially unset by a user.

3. Verify the mode on a pilot host (expected output: ConstrainedLanguage):
   $ExecutionContext.SessionState.LanguageMode

4. Confirm the control does what it is here for -- these must now fail:
   [System.Reflection.Assembly]::LoadWithPartialName("System.Management.Automation")
   New-Object -ComObject WScript.Shell

5. Expand ring by ring, reviewing 4104 logs and helpdesk tickets at each stage.

6. ROLLBACK at any ring: set the AppLocker Script rule enforcement back to
   "Audit only" and refresh policy (gpupdate /force). New PowerShell sessions
   return to FullLanguage immediately; no reboot and no reimage needed.

Sequencing matters here. Isolating the endpoint without revoking cloud sessions leaves the attacker holding a valid refresh token and an attacker-registered device — they keep the tenant access and simply lose one laptop. Phase 2 runs in parallel with Phase 1, not after it.

Thirteen CQL queries ship: six are alert-ready on day one (Q1, Q2, Q3, Q5, Q6, Q7) and seven are hunt-only until the benign baseline in gate G3 produces a documented exclusion set. The material gaps are all structural rather than fixable by another query: the venue network is not instrumented, attacker device registration and the collection modules produce no discrete Falcon event, and the Android variant is outside this telemetry entirely. The single most consequential dependency is gate G2 — if Entra sign-in logs are not ingested, Q13 and the whole identity half of this pack do not run, and the branch of the campaign that survives reimaging goes unwatched. Validate G1 and G2 before trusting any coverage claim on this page.

Source snapshots for every citation above are preserved alongside this pack in CaptiveCrunch-Storm2945-Hunt-sources/, one plain-text file per source, so that every atomic indicator shipped here can be traced back to the text it came from.