Skyw4lker: Microsoft Device-Code Phishing Kit
A phishing kit that abuses the OAuth 2.0 device authorization grant to take over Microsoft 365 accounts without stealing a password. No attributed actor. Shares code and hosting lineage with the Gabagool kit.
01
Executive Summary
Skyw4lker is a phishing kit that automates Microsoft 365 account takeover through the OAuth 2.0 device authorization grant (the "device code" flow, RFC 8628). ANY.RUN published the analysis on 2026-10-27 and The Hacker News carried a contributed write-up on 2026-10-28. The kit gives the victim a real Microsoft device code and tells them to enter it at Microsoft's own sign-in page. When the victim completes the request, the attacker's backend, which has been polling, receives the Microsoft 365 tokens. No password has to be stolen and the victim satisfies MFA on genuine Microsoft infrastructure.
What is kit-specific here. The lure is a password-protected PDF, DOCX or XLSX (password in the email body) that links to a CAPTCHA page, sometimes through a lure page on Miro, Google Sites or Zoom. The page runs obfuscated JavaScript against a PHP backend: session_public.php with action=start registers the victim with IP and geolocation, then repeated action=poll calls wait for authentication. Landing tokens follow //it[A-Za-z0-9]{32}us (earlier //zt...op). ANY.RUN lists 173 hosting domains, finds the kit shares JavaScript modules, the landing-URL format and part of its hosting with a credential-phishing kit called Gabagool, and assesses with high confidence that both were built by the same developer.
Scale and targeting, as reported. ANY.RUN counted 618 sandbox analyses between June and 2026-10-21, with monthly volume rising from about 20 in June to about 200 in September. It attributes 46% of submissions to the United States in its summary and 47% in a later section (the post states both). Submitting organisations were mainly in technology, manufacturing and government. The Hacker News, in a piece it labels as contributed by a partner, says the campaign has focused on manufacturing, technology and healthcare. Those are sandbox-submission and vendor-narrative figures, not a confirmed victim census. No threat actor is attributed: ANY.RUN says the data does not let it distinguish one operator from several customers of the same platform.
What Falcon can and cannot see. Token theft happens entirely at Microsoft's identity plane and leaves no endpoint artefact. Falcon sees the document being opened, a browser started with a URL argument, DNS lookups and IP connections. Falcon does not see URL paths inside a running browser, so the kit's own backend paths (
session_public.php, client_geo.js, the CAPTCHA widget) are proxy or web-gateway telemetry. The identity queries (Q8 to Q10) need Entra and Microsoft 365 logs in Next-Gen SIEM. The generic device-code primitive is covered in depth by the library's existing device-code pack; this pack concentrates on the kit-specific angles.Defender priority. (1) Put a Conditional Access policy in report-only that blocks the device code flow, review the sign-in log impact, then enforce it. Microsoft recommends blocking it wherever possible. (2) Ingest interactive and non-interactive Entra sign-in logs plus the audit log, and run Q8 and Q9. (3) Import the section 10 CSV as detect only: every indicator is single-sourced to ANY.RUN, so nothing here is eligible for a prevent action.
02
Source Review & Web Hunter Notes
Every atomic indicator in this pack was read from the saved ANY.RUN snapshot in Skyw4lker-DeviceCode-PhishKit-Hunt-sources/; the IOC provenance gate traces each one back to it. The indicator set is single-sourced.
| Tier | Source | Key finding / use | Carry forward | Snapshot |
|---|---|---|---|---|
| T1 vendor research | ANY.RUN: SkyW4lker Exposed (2026-10-27) | Primary and only technical source: kit mechanics, URL patterns, TTPs, 173 domains, IPs, sample hash, Gabagool comparison, detection guidance, scale figures | yes | 01-anyrun-skyw4lker.txt |
| T3 trade press (contributed) | The Hacker News (2026-10-28) | Sector focus (manufacturing, technology, healthcare), sites.google.com lure hop, summary of kit behaviour. The page states it is a contributed partner piece, so it is NOT independent corroboration of ANY.RUN | partial | 02-thehackernews.txt |
| T3 secondary | Daily CyberSecurity on TRAC Labs Gabagool | Background only. Undated, describes a Cloudflare R2 AiTM kit; not confirmed to be the same Gabagool as ANY.RUN's April 2026 kit, so no lineage claim rests on it | partial | 03-securityonline-trac-gabagool-secondary.txt |
| T3 trade press | Cyber Security News: OAuth device code abuse (2026-03-12) | Generic device-code primitive and why it defeats standard controls. Its network indicators belong to a different campaign and were NOT used | partial | 04-cybersecuritynews-device-code-generic.txt |
| T1 vendor docs | Microsoft Learn: block authentication flows | Hardening authority: block device code flow, report-only first, exclude break-glass | yes | 05-msft-ca-block-authentication-flows.txt |
| T1 vendor docs | Microsoft Learn: authentication flows | Device code flow is high risk; block wherever possible; authentication-protocol filter and protocol tracking | yes | 06-msft-ca-authentication-flows.txt |
| T1 vendor docs | Microsoft Learn: revoke user access | Containment: Revoke-MgUserSignInSession, refresh and access token behaviour, CAE | yes | 07-msft-revoke-user-access.txt |
| T1 vendor docs | Microsoft Learn: mail flow rule conditions and New-TransportRule | Password-protected attachment condition (Office, archive and PDF) and rule parameters | yes | 08-msft-mailflow-rule-conditions.txt, 09-msft-new-transportrule.txt |
| T1 vendor docs | Graph: conditionalAccessAuthenticationFlows | transferMethods value deviceCodeFlow for the policy body | yes | 10-msft-graph-ca-authentication-flows.txt |
| T1 vendor docs | Microsoft Learn: configure user consent and CA user actions | Consent restriction and the Register security information user action | yes | 11-msft-configure-user-consent.txt, 12-msft-ca-user-actions.txt |
| T1 reference | MITRE ATT&CK T1528 and RFC 8628 | Technique mitigations (M1047, M1021, M1018, M1017) and the legitimate protocol being abused | yes | 13-mitre-t1528.txt, 14-rfc8628.txt |
| Dropped (unreachable) | TRAC Labs: Gabagool analysis | Automated fetch returned HTTP 403 (Cloudflare block). Not retrieved, not snapshotted, not cited as evidence. The Gabagool lineage in this pack rests on ANY.RUN's own comparison table | no | none |
Decisions and discrepancies
- Not independently corroborated. The Hacker News page identifies itself as a contributed piece from a partner and restates ANY.RUN's research. Treat it as one source, not two. This is why nothing in the pack is a prevent or critical indicator.
- US share: ANY.RUN's summary says 46% and its later section says 47%. The pack prints both.
- Sectors differ by source: ANY.RUN says submissions came mainly from technology, manufacturing and government. The Hacker News says the campaign has focused on manufacturing, technology and healthcare. Healthcare is a single-source claim.
- "No password stolen" needs a footnote. ANY.RUN's TTP table also records that the shared
endpoint.jsmodule logs e-mail, password, browser and MFA status toaccounts.php. That module is shared with Gabagool's credential mode. The device-code mode does not need a password, but a victim who also saw a credential form should be treated as password-exposed. The runbook resets the password regardless. - Hash scope: the one hash is a lure document, not an executable. Falcon's file-hash fields describe executables, so it is a mail-security and sandbox indicator (section 7, N3), not an endpoint hunt.
- Gabagool naming: an older secondary article describes a Cloudflare R2 AiTM kit also called Gabagool. ANY.RUN's Gabagool is first seen 2026-04-23 and harvests logins through
accounts.php. They may be the same family or a name collision; no Gabagool-only indicator is imported here.
03
Hunt Brief & Attack Chain
Hypotheses (highest fidelity first)
- H1: a host started a browser from a document with a kit URL token or asset path. T1566.002, T1204.001. High confidence, no known benign use for the token grammar. Q2.
- H2: a user's device-code events span two networks. T1528, T1550.001. Q9, with Q8 as the baseline view.
- H3: a lure-pattern document and a look-alike Microsoft hostname lookup occur on one host in 15 minutes. T1566.001, T1583.001. Q3, Q4.
- H4: a host resolved or connected to reported kit infrastructure. T1583.001, T1583.003. Q5, Q6, Q7. Single-sourced, detect only.
- H5: a lure-named document was opened. T1566.001. Q1. Scoping only.
- H6: a device-code sign-in is followed by a mailbox rule, consent grant or MFA method registration. T1114.003, T1098.005. Q10. Analyst extension, not reported for this kit.
Attack chain
| Step | Behaviour | Telemetry | Hunt angle |
|---|---|---|---|
| 1 Lure email | Phishing email with a password-protected PDF, DOCX or XLSX; password in the body. Subjects mimic contracts, statements and funds-transfer notices | Email gateway (outside endpoint telemetry) | N3 attachment name and hash search; H3 mail flow rule |
| 2 Document opened | Victim opens the attachment in a reader or Office app (lure names <name>-protected.pdf, DOC <10 chars>.pdf) | Process creation with command line (CrowdStrike: ProcessRollup2. SentinelOne: Process Creation. Defender: DeviceProcessEvents) | Q1, Q3 |
| 3 Link to CAPTCHA / lure page | Document link opens a CAPTCHA page (Cloudflare Turnstile or the kit's own widget), sometimes via Miro, Google Sites or Zoom | Process creation with URL argument (as above) and web proxy URL logs (outside endpoint telemetry) | Q2, N1 |
| 4 Session registered | Obfuscated JS loads client_geo.js, geolocates the visitor, calls session_public.php?action=start | Web proxy / gateway URL logs only (outside endpoint telemetry) | N1 |
| 5 Device code shown | Page shows a real Microsoft device code and sends the victim to login.microsoft.com/device | Browser navigation (outside endpoint telemetry unless a process is started with the URL) | Q2 (partial), N1 |
| 6 Victim authenticates | Victim enters the code on Microsoft's page and completes MFA | Entra sign-in logs (outside endpoint telemetry) | Q8, Q9 |
| 7 Backend polls and collects tokens | session_public.php?action=poll repeats every few seconds until authentication completes; tokens go to the attacker | Proxy logs for the poll; Entra non-interactive sign-in logs for the redemption | N1, Q9 |
| 8 Account use | Mailbox access and follow-on actions (inbox rules, consent, MFA method registration). These are analyst extensions: ANY.RUN does not report post-compromise behaviour | Exchange and Entra audit logs | Q10 |
| Infrastructure | 173 hosting domains, DigitalOcean backend IPs, one IP shared with Gabagool, an admin panel at /admin/index.php | DNS (CrowdStrike: DnsRequest. SentinelOne: DNS Resolved. Defender: DeviceEvents) and network connection telemetry (CrowdStrike: NetworkConnectIP4) | Q4, Q5, Q6, Q7 |
No actor is attributed. ANY.RUN states the available data cannot separate a single operator from several customers of one platform, and this pack does not invent a cluster name.
04
Consolidated IOC Table
All indicators are single-sourced to ANY.RUN and ship DETECT only. Several of the 173 domains look like compromised or ordinary business sites. Legitimate services seen in the lure chain (sites.google.com, miro.com, zoom.us, login.microsoft.com, login.microsoftonline.com) are context, never indicators, and must not be blocked.
| Type | Value | Confidence | Action | Context |
|---|---|---|---|---|
| sha256 | 9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268 | MEDIUM | detect | Sample lure document analysed by ANY.RUN (password-protected PDF). A document hash, not an executable; use in mail security and sandbox |
| ipv4 | 162.243.64.121 | MEDIUM | detect | DigitalOcean backend IP (ANY.RUN: 50 of 92 backend IPs are DigitalOcean). Rented VPS space, reassigned over time |
| ipv4 | 67.205.154.32 | MEDIUM | detect | DigitalOcean backend IP, same reporting |
| ipv4 | 172.86.85.51 | MEDIUM | detect | IP ANY.RUN reports as shared between this kit and Gabagool (it also serves a listed domain). Shared infrastructure for THIS kit; no Gabagool-only indicator is imported |
| domain (173) | see list below and the section 10 CSV | MEDIUM | detect | Domains hosting the kit, observed 2026-06-23 to 2026-10-21. Includes dynamic-DNS subdomains, look-alike company domains and Microsoft-themed hostname chains |
| URL pattern | //it[A-Za-z0-9]{32}us (may end ? or ??); earlier //zt[A-Za-z0-9]{32}op | HIGH | hunt | Landing page token. Seen 2026-08-10 to 2026-10-19 and 2026-06-25 to 2026-09-28. Behavioural, survives domain rotation |
| URL pattern | /assets/php/endpoints/session_public.php?action=start and ?action=poll&session_id= | HIGH | hunt | Session registration with geolocation, then polling for device-code completion. ANY.RUN's lead hunt guidance |
| URL pattern | /assets/js/client_geo.js, /assets/js/endpoint.js, /assets/js/url_helper.js, /assets/php/endpoints/confirm_visit.php | MEDIUM | hunt | Modules shared with Gabagool |
| URL pattern | /assets/private_captcha/public/widget.js?v=4, widget.css, /assets/php/endpoints/private_captcha_challenge.php | MEDIUM | hunt | Self-hosted CAPTCHA gate |
| URL pattern | /assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[A-Za-z0-9]{50}.js | MEDIUM | hunt | Brand-specific document script |
| URL path | /admin/index.php | LOW | enrich | Kit administration panel. Too generic alone; only meaningful on a host that also serves the modules above |
| Filename | <name>-protected.pdf, DOC <10 random characters>.pdf | MEDIUM | hunt | Lure attachment names (Q1, Q3) |
| Hostname grammar | prefix docshare, sdocshares, pdocshared, pdfdocshared, efaxdoc, reauth, statement, copilot, login, auth then outlook, onedrive, copilot, office365 | MEDIUM | hunt | Microsoft-themed chain on look-alike domains (Q3, Q4) |
| Context only | sites.google.com, miro.com, zoom.us, login.microsoft.com, login.microsoftonline.com | CONTEXT | never block | Legitimate services abused as lure hops or as the genuine sign-in page |
The full list of 173 hosting domains is in the section 10 CSV (fanged, import-ready) and the ANY.RUN post (defanged). Examples ANY.RUN names in its text: 5200m[.]com, torvion[.]life, ghethim[.]com, priorispace[.]biz, csr-rooflng[.]com. Dynamic-DNS subdomains and Microsoft-themed hostname chains are covered by the same CSV and by Q3/Q4.
05
Affected Surface & Telemetry Matrix
| Surface | Telemetry | Priority | Gap risk |
|---|---|---|---|
| Managed Windows, macOS or Linux endpoint with a document reader or Office | Process creation with command line (CrowdStrike: ProcessRollup2. SentinelOne: Process Creation. Defender: DeviceProcessEvents) | HIGH | Browser navigation inside a running browser has no URL path in endpoint telemetry |
| Endpoint name resolution | DNS lookup with requesting process (CrowdStrike: DnsRequest. SentinelOne: DNS Resolved. Defender: DeviceEvents, DNS action type) | HIGH | Unmanaged and personal devices have no sensor; DNS over HTTPS bypasses the resolver path |
| Endpoint outbound connections | Outbound network connection (CrowdStrike: NetworkConnectIP4. SentinelOne: IP Connect. Defender: DeviceNetworkEvents) | MEDIUM | IP indicators are reassigned VPS addresses; low shelf life |
| Web gateway / proxy | Full URL and path logs | HIGH | Outside endpoint telemetry. The only place the session_public.php start/poll pattern is visible |
| Email gateway | Attachment name, type, hash and password-protected flag | HIGH | Outside endpoint telemetry. Not ingested by default |
| Entra ID sign-in logs | Interactive and non-interactive sign-ins with authentication protocol | CRITICAL | Outside endpoint telemetry. Token theft is visible here only; requires log ingestion and a parser that preserves the protocol |
| Entra audit and Exchange / Microsoft 365 audit | Consent, security-info registration, inbox and transport rules | HIGH | Outside endpoint telemetry. Mailbox auditing must be on |
The token theft itself leaves no endpoint artefact: the victim authenticates on Microsoft's page and the attacker's server redeems the code.
06
ATT&CK Mapping
| Tactic | Technique | Name | Observed behaviour | Query / control | Basis |
|---|---|---|---|---|---|
| Reconnaissance | T1589.002 | Gather Victim Identity Information: Email Addresses | Recipient e-mail personalisation via the landing-URL suffix (? or ??) after the token | N1 | ANY.RUN |
| Reconnaissance | T1590.005 | Gather Victim Network Information: IP Addresses | client_geo.js and session_public.php?action=start&ip= record IP, ISP, org and location | N1 | ANY.RUN |
| Resource Development | T1583.001 | Acquire Infrastructure: Domains | Look-alike company domains, Microsoft-themed subdomain chains and dynamic-DNS subdomains | Q3, Q4, Q5, Q6 | ANY.RUN |
| Resource Development | T1583.003 | Acquire Infrastructure: Virtual Private Server | DigitalOcean hosting for the PHP backend | Q7 | ANY.RUN |
| Resource Development | T1608.005 | Stage Capabilities: Link Target | Intermediate pages on public cloud buckets and site builders | N1 | ANY.RUN |
| Initial Access | T1566.001 | Phishing: Spearphishing Attachment | Password-protected PDF, DOCX, XLS(X) or EML; password in the email body | Q1, Q3, N3 | ANY.RUN |
| Initial Access | T1566.002 | Phishing: Spearphishing Link | Links on Google Sites, Miro, Zoom and similar, including a maps.google redirect | Q2, N1 | ANY.RUN |
| Execution | T1204.001 | User Execution: Malicious Link | Victim opens the landing link to start a session | Q2 | ANY.RUN |
| Defense Evasion | T1656 | Impersonation | Routine business correspondence as lure | N3 | ANY.RUN |
| Defense Evasion | T1497 | Virtualization/Sandbox Evasion | Cloudflare Turnstile and a self-hosted CAPTCHA before the phishing page | N1 | ANY.RUN |
| Defense Evasion | T1027 | Obfuscated Files or Information | obfuscator.io style JavaScript (520 of 618 analyses tagged obfuscated-js) | N1 | ANY.RUN |
| Credential Access | T1528 | Steal Application Access Token | OAuth device-code flow against the Microsoft device sign-in endpoints while polling the backend | Q2, Q8, Q9 | ANY.RUN |
| Collection | T1056.003 | Input Capture: Web Portal Capture | Shared endpoint.js logs e-mail, password, browser, MFA status to accounts.php (Gabagool credential mode) | N1 | ANY.RUN |
| Credential Access | T1550.001 | Use Alternate Authentication Material: Application Access Token | Redeemed tokens used from attacker infrastructure. Analyst extension, not reported for this kit | Q9, Q10 | Analyst |
| Collection | T1114.003 | Email Collection: Email Forwarding Rule | Mailbox rules after takeover. Analyst extension | Q10 | Analyst |
| Persistence | T1098.005 | Account Manipulation: Device Registration | MFA method or device registration after takeover. Analyst extension; check the Register security info activity | Q10 | Analyst |
Rows marked "Analyst" are plausible follow-on behaviour that no source reports for this kit. They are included so the identity hunt is useful, and are labelled so they are not read as attributed tradecraft.
07
Native Audit-Log Hunts
Falcon endpoint telemetry cannot see the kit's backend paths. These checks run in the proxy, web gateway, mail and identity tools you already have.
N1 Web proxy / secure web gateway: kit URL grammar
Search URL path logs for these regular expressions (PCRE syntax; the first two are ANY.RUN's lead hunt guidance). A single action=poll hit repeated every few seconds from one client is the polling loop. Review the host for the other modules before concluding anything, because /admin/index.php and the bare module names are generic.
session_public\.php\?action=(start|poll)
/assets/php/endpoints/(session_public|confirm_visit|private_captcha_challenge|client_geo|accounts)\.php
/assets/js/(client_geo|endpoint|url_helper)\.js
/assets/private_captcha/public/widget\.(js|css)
/assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[A-Za-z0-9]{50}\.js
//(it[A-Za-z0-9]{32}us|zt[A-Za-z0-9]{32}op)(\?{1,2})?$
N2 Entra admin center: device-code sign-ins and protocol tracking
1. Entra admin center > Monitoring & health > Sign-in logs, then add the filter "Authentication Protocol" = Device code flow. Do this for BOTH the interactive and the non-interactive tabs (the attacker's redemption appears as non-interactive). 2. In Activity details, read "Original transfer method". A session that started with device code keeps that value; Conditional Access protocol tracking will block later refreshes. 3. After enforcing the block policy, error AADSTS530036 on a refresh means a device-code session was protocol tracked and its token is now unusable. Treat those users as targeted. 4. Source: Microsoft Learn "Conditional Access: authentication flows" (snapshot 06).
N3 Microsoft Defender for Office 365 (Advanced Hunting, KQL): lure attachments by name and hash
// Validate column names in your tenant before scheduling
EmailAttachmentInfo
| where Timestamp > ago(30d)
| where FileName matches regex @"(?i)(-protected\.(pdf|docx?|xlsx?)|^DOC [A-Za-z0-9]{10}\.pdf$)"
or SHA256 == "9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268"
| project Timestamp, NetworkMessageId, SenderFromAddress, RecipientEmailAddress, FileName, FileType, SHA256
N4 Analyst checklist
- Which users received a password-protected attachment from an external sender in the last 30 days? Confirm with message trace, not only with Q1.
- For each opener, did a device-code event follow within 24 hours (N2)? If yes, treat as compromised until proven otherwise.
- Did the same user register an MFA method, grant consent or create a mailbox rule in that window (Q10)?
- Does the proxy show a kit module path (N1) from that host, and which lure hop (Google Sites, Miro, Zoom) preceded it?
08
Hunt Queries: CrowdStrike CQL, SentinelOne PowerQuery and Defender XDR KQL
Show all queries inMixed: some cards were switched on their own
Use your tenant's own address. SentinelOne does not document a link that pre-fills a query, so each "Copy & open SentinelOne" button copies the query and opens this console: paste it into PowerQuery.
Pick your portal. Microsoft documents a Share link in advanced hunting but not its URL format, so each "Copy & open Defender" button copies the query and opens Advanced hunting: paste it into the editor.
Pick your tenant's cloud first: every "Open in Falcon" button below uses this selection.
Q1 to Q7 run on endpoint telemetry. Q8 to Q10 need Entra and Microsoft 365 logs in Next-Gen SIEM and use ECS-aligned field names; raw Microsoft names are kept in the comments only. Confirm field names on one real row first (Gate 2).
Q1 · Password-protected lure document opened (Skyw4lker filename patterns)
CONF MEDIUMFP MEDIUMCOST LOW
Looks for: A PDF reader, Office app or browser started with a document whose name matches the two lure shapes ANY.RUN reports: <name>-protected.pdf and DOC <10 random characters>.pdf. The document is only the first hop, so this is a scoping hunt that tells you which hosts to pivot from, not a verdict.
FP: legitimate password-protected files that happen to carry a -protected suffix (HR, legal, finance exchanges). The ten-character DOC xxxxxxxxxx.pdf shape is far more specific than the suffix. Exclude known protected-document exchange users, or run the ten-character shape alone for a high-precision first pass.
Validation: schema-aligned, static-reviewedAutomated: static-passedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
- PowerQuery: A document opened by an application that does not carry the path on its command line is not captured.
- PowerQuery assumes: On a Process Creation event tgt.process.* is the created process and src.process.* is its creator, so the document application is tgt.process.name.
- PowerQuery assumes: The document path appears in tgt.process.cmdline for readers and Office applications.
- KQL – Defender XDR: A document opened by an application that does not carry the path on its command line is not captured.
- KQL – Defender XDR assumes: ProcessCommandLine carries the document path for readers and Office applications.
// HUNT: password-protected lure document opened by a reader, Office app or browser (Skyw4lker lure filename patterns) // MITRE: T1566.001, T1204.001 | CONF: medium FP: medium COST: low // REQUIRES: Falcon process telemetry (ProcessRollup2 / SyntheticProcessRollup2) with command line // FALSE POSITIVES: legitimate password-protected PDF/Office files named with a "-protected" suffix; // the "DOC <10 characters>.pdf" shape is much more specific than the suffix // TUNING: exclude users and shares that routinely exchange protected documents; for a high-precision // first pass keep only the DOC <10 characters>.pdf shape; add a ParentBaseFileName filter for // OUTLOOK / explorer to keep only documents opened straight from mail or a download // Source: ANY.RUN lists these filename patterns for the lure attachments (single vendor source) // LOOKBACK: 14d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context). #event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | FileName=/^(AcroRd32|Acrobat|FoxitPDFReader|FoxitReader|SumatraPDF|WINWORD|EXCEL|msedge|chrome|firefox)\.exe$/i | CommandLine=/(-protected\.(pdf|docx?|xlsx?)|DOC [A-Za-z0-9]{10}\.pdf)/i | table([@timestamp, aid, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200) | sort(@timestamp, order=desc)
4 required fields · View requirements
Required telemetry
- Process Creation events
Required fields
event.type: Event typeevent.time: Event timetgt.process.name: Created process nametgt.process.cmdline: Created command line
Recommended fields
src.process.name: Creating process
Fallbacks
endpoint.name→agent.uuid: Changes the displayed host identifier only.
Readiness test
event.type = 'Process Creation' tgt.process.cmdline = * | limit 5 | columns event.type, event.time, tgt.process.name, tgt.process.cmdline
// HUNT: password-protected lure document opened by a reader, Office app or browser (Skyw4lker lure filename patterns)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1566.001, T1204.001
// CONF: medium | FP: medium
// FALSE POSITIVES: legitimate password-protected PDF/Office files named with a "-protected" suffix;
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate: a reader, Office app or browser whose command line names a -protected document or a DOC <10 characters>.pdf lure. matches is case-insensitive, which reproduces the CQL /i intent.
// REQUIRES: SentinelOne process-creation telemetry (Process Creation) with command line
// TUNING: Exclude users and shares that routinely exchange protected documents; keep only the DOC <10 characters>.pdf shape for a high-precision first pass; add a src.process.name filter for the mail client to keep documents opened straight from mail.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A document opened by an application that does not carry the path on its command line is not captured.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^(AcroRd32|Acrobat|FoxitPDFReader|FoxitReader|SumatraPDF|WINWORD|EXCEL|msedge|chrome|firefox)\\.exe$' tgt.process.cmdline matches '(-protected\\.(pdf|docx?|xlsx?)|DOC [A-Za-z0-9]{10}\\.pdf)'
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, tgt.process.name, src.process.name, tgt.process.cmdlineAutomated validation: static-passed
Static schema: passed (0 errors, 0 warnings)
Positive fixtures: 0/0 · Benign fixtures: 0/0
Evidence: recorded in the build's validation report (not published)
Checked: 2026-10-28T11:40:00Z · siem-query-rosetta-kql-validator/1.0.0
3 required fields · View requirements
Required telemetry
- DeviceProcessEvents
Required fields
Timestamp: Event timeFileName: Created process nameProcessCommandLine: Created command line
Recommended fields
InitiatingProcessFileName: Initiating process
Fallbacks
DeviceName→DeviceId: Changes the displayed host identifier only.
Readiness test
DeviceProcessEvents | where Timestamp > ago(1d) | project Timestamp, FileName, ProcessCommandLine | take 5
// HUNT: password-protected lure document opened by a reader, Office app or browser (Skyw4lker lure filename patterns)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1566.001, T1204.001
// CONF: medium | FP: medium
// FALSE POSITIVES: legitimate password-protected PDF/Office files named with a "-protected" suffix;
// EQUIVALENCE: equivalent-with-schema-assumptions - Same process-creation predicate on DeviceProcessEvents: the document application by name and a -protected or DOC <10 characters>.pdf command line. The (?i) prefix reproduces the CQL /i intent.
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude users and shares that routinely exchange protected documents; keep only the DOC <10 characters>.pdf shape for a high-precision first pass.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A document opened by an application that does not carry the path on its command line is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where FileName matches regex @"(?i)^(AcroRd32|Acrobat|FoxitPDFReader|FoxitReader|SumatraPDF|WINWORD|EXCEL|msedge|chrome|firefox)\.exe$"
| where ProcessCommandLine matches regex @"(?i)(-protected\.(pdf|docx?|xlsx?)|DOC [A-Za-z0-9]{10}\.pdf)"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, FileName, InitiatingProcessFileName, ProcessCommandLine
| sort by Timestamp desc
| take 200
Q2 · Document app launching a browser with a kit URL or Microsoft device-code endpoint
CONF HIGHFP MEDIUMCOST LOW
Looks for: A PDF reader, Office app or mail client that starts a browser with a command line carrying (a) the kit landing token //it<32>us or //zt<32>op, (b) the Microsoft device-code endpoints, or (c) a kit asset path. This is the closest Falcon gets to the document-to-device-code sequence. Falcon sees a URL only when a process is started with it as an argument; navigation inside an already-running browser is invisible (see the Coverage Map).
FP: the device-code-endpoint branch fires on a user who legitimately opens the Microsoft device page from a mail or document (helpdesk instructions, a CLI sign-in guide). The kit-token and kit-asset branches have no known legitimate use. Promote Q2 as the IOA candidate (section 9).
Validation: schema-aligned, static-reviewedAutomated: static-passedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
- PowerQuery: No signal column: the three branches are told apart from the command line.
- PowerQuery assumes: On a Process Creation event tgt.process.* is the browser and src.process.* is the document application that launched it.
- PowerQuery assumes: The query returns the matching rows but does not compute the signal label the CQL adds; read the command line to tell the three branches apart.
- KQL – Defender XDR: A browser launched through an intermediate process is not captured.
- KQL – Defender XDR assumes: InitiatingProcessFileName is the document application that launched the browser.
// HUNT: document reader / Office / mail client spawning a browser with a Skyw4lker URL grammar or a Microsoft device-code endpoint // MITRE: T1566.002, T1204.001, T1528 | CONF: high FP: medium COST: low // REQUIRES: Falcon process telemetry (ProcessRollup2 / SyntheticProcessRollup2) with command line and parent // FALSE POSITIVES: IT or helpdesk documents that deliberately link to the Microsoft device sign-in page; // the kit-landing-token and kit-asset-path branches have no known benign use // TUNING: exclude the device-code-endpoint branch for OUTLOOK-parented rows from helpdesk mailboxes; // treat a kit-landing-token row as confirmed-suspicious and a device-code-endpoint row as hunt-grade // Source: URL grammar and device-code endpoints are the ones ANY.RUN reports for this kit // LOOKBACK: 14d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context). #event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | FileName=/^(msedge|chrome|firefox|brave|iexplore)\.exe$/i | ParentBaseFileName=/^(AcroRd32|Acrobat|FoxitPDFReader|FoxitReader|SumatraPDF|WINWORD|EXCEL|OUTLOOK|olk)\.exe$/i | case { CommandLine=/\/\/(it[A-Za-z0-9]{32}us|zt[A-Za-z0-9]{32}op)/ | signal := "kit-landing-token"; CommandLine=/(session_public\.php|private_captcha|client_geo\.js|mstoken_document_)/i | signal := "kit-asset-path"; CommandLine=/(login\.microsoft(online)?\.com\/(device|common\/oauth2\/deviceauth)|microsoft\.com\/devicelogin)/i | signal := "device-code-endpoint"; * | signal := "none"; } | signal != "none" | table([@timestamp, aid, ComputerName, UserName, signal, ParentBaseFileName, FileName, CommandLine], limit=200) | sort(@timestamp, order=desc)
5 required fields · View requirements
Required telemetry
- Process Creation events
Required fields
event.type: Event typeevent.time: Event timetgt.process.name: Created process namesrc.process.name: Creating process nametgt.process.cmdline: Created command line
Fallbacks
endpoint.name→agent.uuid: Changes the displayed host identifier only.
Readiness test
event.type = 'Process Creation' tgt.process.cmdline = * | limit 5 | columns event.type, event.time, tgt.process.name, src.process.name, tgt.process.cmdline
// HUNT: document reader / Office / mail client spawning a browser with a Skyw4lker URL grammar or a Microsoft device-code endpoint
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1566.002, T1204.001, T1528
// CONF: high | FP: medium
// FALSE POSITIVES: IT or helpdesk documents that deliberately link to the Microsoft device sign-in page;
// EQUIVALENCE: equivalent-with-schema-assumptions - Same population: a browser created by a document reader, Office application or mail client whose command line has a kit landing token, a kit asset path or a Microsoft device-code endpoint. The landing-token branch is matched case-sensitively as in the CQL; the other two are case-insensitive.
// REQUIRES: SentinelOne process-creation telemetry (Process Creation) with command line and creating process
// TUNING: Exclude the device-code-endpoint branch for mail-client rows from helpdesk mailboxes; treat a landing-token row as confirmed-suspicious and a device-code-endpoint row as hunt-grade.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: No signal column: the three branches are told apart from the command line.
// VALIDATION LEVEL: static-reviewed
event.type = 'Process Creation' tgt.process.name matches '^(msedge|chrome|firefox|brave|iexplore)\\.exe$' src.process.name matches '^(AcroRd32|Acrobat|FoxitPDFReader|FoxitReader|SumatraPDF|WINWORD|EXCEL|OUTLOOK|olk)\\.exe$' (tgt.process.cmdline matches:matchcase '//(it[A-Za-z0-9]{32}us|zt[A-Za-z0-9]{32}op)' or tgt.process.cmdline matches '(session_public\\.php|private_captcha|client_geo\\.js|mstoken_document_)' or tgt.process.cmdline matches '(login\\.microsoft(online)?\\.com/(device|common/oauth2/deviceauth)|microsoft\\.com/devicelogin)')
| sort -event.time
| limit 200
| columns event.time, endpoint.name, src.process.user, src.process.name, tgt.process.name, tgt.process.cmdlineAutomated validation: static-passed
Static schema: passed (0 errors, 0 warnings)
Positive fixtures: 0/0 · Benign fixtures: 0/0
Evidence: recorded in the build's validation report (not published)
Checked: 2026-10-28T11:40:00Z · siem-query-rosetta-kql-validator/1.0.0
4 required fields · View requirements
Required telemetry
- DeviceProcessEvents
Required fields
Timestamp: Event timeFileName: Created process nameInitiatingProcessFileName: Initiating processProcessCommandLine: Created command line
Fallbacks
DeviceName→DeviceId: Changes the displayed host identifier only.
Readiness test
DeviceProcessEvents | where Timestamp > ago(1d) | project Timestamp, FileName, InitiatingProcessFileName, ProcessCommandLine | take 5
// HUNT: document reader / Office / mail client spawning a browser with a Skyw4lker URL grammar or a Microsoft device-code endpoint
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1566.002, T1204.001, T1528
// CONF: high | FP: medium
// FALSE POSITIVES: IT or helpdesk documents that deliberately link to the Microsoft device sign-in page;
// EQUIVALENCE: equivalent-with-schema-assumptions - Same population on DeviceProcessEvents: a browser whose initiating process is a document reader, Office application or mail client, with the three command-line branches and a signal column as in the CQL. The landing-token branch is case-sensitive, the others carry (?i).
// REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents)
// TUNING: Exclude the device-code-endpoint branch for mail-client rows from helpdesk mailboxes; treat a landing-token row as confirmed-suspicious.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: A browser launched through an intermediate process is not captured.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceProcessEvents
| where Timestamp >= ago(14d)
| where FileName matches regex @"(?i)^(msedge|chrome|firefox|brave|iexplore)\.exe$"
| where InitiatingProcessFileName matches regex @"(?i)^(AcroRd32|Acrobat|FoxitPDFReader|FoxitReader|SumatraPDF|WINWORD|EXCEL|OUTLOOK|olk)\.exe$"
| extend signal = case(ProcessCommandLine matches regex @"//(it[A-Za-z0-9]{32}us|zt[A-Za-z0-9]{32}op)", "kit-landing-token", ProcessCommandLine matches regex @"(?i)(session_public\.php|private_captcha|client_geo\.js|mstoken_document_)", "kit-asset-path", ProcessCommandLine matches regex @"(?i)(login\.microsoft(online)?\.com/(device|common/oauth2/deviceauth)|microsoft\.com/devicelogin)", "device-code-endpoint", "none")
| where signal != "none"
| project Timestamp, ReportId, DeviceId, DeviceName, AccountName, signal, InitiatingProcessFileName, FileName, ProcessCommandLine
| sort by Timestamp desc
| take 200
Q3 · Lure document open and look-alike Microsoft-themed hostname lookup on the same host within 15 minutes
CONF MEDIUMFP MEDIUMCOST MEDIUM
Looks for: Two stages on one sensor inside the same 15-minute bucket: a lure-pattern document opened by a reader or browser, and a DNS lookup for a hostname that follows the Microsoft-themed chain ANY.RUN reports (a docshare / sdocshares / pdocshared / efaxdoc / reauth / statement / copilot / login / auth prefix with an outlook / onedrive / copilot / office365 word later), excluding real Microsoft domains. Bucketed, not strictly ordered, so a hit near a bucket edge can be missed.
FP: third-party SaaS that uses a login. or auth. prefix next to a Microsoft product word in its own domain, coinciding with an unrelated protected document. Tune the Microsoft-domain exclusion to your estate and review both stages in the row before escalating.
Validation: static-reviewedEquivalence: approximate-analytic, unsupported-without-redesignProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
- PowerQuery: The matched command lines and look-alike names are not listed; use the Q1 and Q4 tabs for them.
- PowerQuery: A lure and a lookup that straddle a bucket boundary are missed, as in the CQL.
- PowerQuery assumes: The bucket is aligned to the event time, as in the CQL, so a lure and a lookup a few minutes apart can fall in adjacent buckets.
- PowerQuery assumes: DNS Resolved events carry the queried name in event.dns.request.
- KQL – Defender XDR: The two-stage correlation by host and 15-minute bucket is not expressed in KQL.
// HUNT: lure document open plus Microsoft-themed look-alike hostname lookup on one host within 15 minutes // MITRE: T1566.001, T1566.002, T1583.001 | CONF: medium FP: medium COST: medium // REQUIRES: Falcon process telemetry (ProcessRollup2) and DNS telemetry (DnsRequest) on the same sensor // FALSE POSITIVES: SaaS vendors whose own domain pairs a login/auth prefix with a Microsoft product word, // landing in the same 15-minute window as an unrelated protected document // TUNING: extend the Microsoft-domain exclusion with your tenant vanity and partner domains; // raise to three stages by adding the Q2 signal if the host also launched a browser from the document; // the 15-minute bucket is not strictly ordered, so read FirstSeen/LastSeen before escalating // Source: hostname chain grammar and lure filename shapes are those ANY.RUN reports // LOOKBACK: 14d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context). #event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|DnsRequest)$/ | case { FileName=/^(AcroRd32|Acrobat|FoxitPDFReader|FoxitReader|SumatraPDF|WINWORD|EXCEL|msedge|chrome|firefox)\.exe$/i CommandLine=/(-protected\.(pdf|docx?|xlsx?)|DOC [A-Za-z0-9]{10}\.pdf)/i | stage := "lure-doc-open"; DomainName=/^(docshare|sdocshares|pdocshared|pdfdocshared|efaxdoc|reauth|statement|copilot|login|auth)[a-z0-9.-]*(outlook|onedrive|copilot|office365)/i DomainName!=/(^|\.)(microsoft|microsoftonline|office|office365|office\.net|live|sharepoint|outlook|onedrive|windows|azure|msauth|msftauth|microsoft365)\.(com|net|cloud)$/i | stage := "lookalike-host-dns"; * | stage := "none"; } | stage != "none" | Bucket15m := @timestamp - (@timestamp % 900000) | groupBy([aid, Bucket15m], function=[count(stage, distinct=true, as=stages), collect([ComputerName]), collect([UserName]), collect([stage]), collect([DomainName]), collect([CommandLine]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=20000) | stages >= 2 | sort(LastSeen, order=desc)
6 required fields · View requirements
Required telemetry
- Process Creation events
- DNS Resolved events
Required fields
event.type: Event typeevent.time: Event timetgt.process.name: Created process nametgt.process.cmdline: Created command lineevent.dns.request: Queried nameagent.uuid: Agent identity
Fallbacks
endpoint.name→agent.uuid: Changes the displayed host identifier only.
Readiness test
event.type = 'DNS Resolved' event.dns.request = * | limit 5 | columns event.type, event.time, agent.uuid, event.dns.request, tgt.process.name, tgt.process.cmdline
// HUNT: lure document open plus Microsoft-themed look-alike hostname lookup on one host within 15 minutes
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1566.001, T1566.002, T1583.001
// CONF: medium | FP: medium
// FALSE POSITIVES: SaaS vendors whose own domain pairs a login/auth prefix with a Microsoft product word,
// EQUIVALENCE: approximate-analytic - Same two-stage idea on one event stream: per host and 15-minute bucket, a lure-document open and a look-alike hostname lookup. The CQL counts distinct stage labels; this counts events of each stage and requires both, which is the same test for two stages. It does not list the matched command lines or names.
// REQUIRES: SentinelOne process-creation and DNS telemetry (Process Creation, DNS Resolved) on the same agent
// TUNING: Extend the Microsoft-domain exclusion with tenant vanity and partner domains; run Q1 and Q4 for the matched command lines and names; the 15-minute bucket is not strictly ordered, so read first_seen and last_seen before escalating.
// LOOKBACK: 14d; extend to 30d for the incident window
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: The matched command lines and look-alike names are not listed; use the Q1 and Q4 tabs for them. A lure and a lookup that straddle a bucket boundary are missed, as in the CQL.
// VALIDATION LEVEL: static-reviewed
(event.type = 'Process Creation' tgt.process.name matches '^(AcroRd32|Acrobat|FoxitPDFReader|FoxitReader|SumatraPDF|WINWORD|EXCEL|msedge|chrome|firefox)\\.exe$' tgt.process.cmdline matches '(-protected\\.(pdf|docx?|xlsx?)|DOC [A-Za-z0-9]{10}\\.pdf)') or (event.type = 'DNS Resolved' event.dns.request matches '^(docshare|sdocshares|pdocshared|pdfdocshared|efaxdoc|reauth|statement|copilot|login|auth)[a-z0-9.-]*(outlook|onedrive|copilot|office365)' !(event.dns.request matches '(^|\\.)(microsoft|microsoftonline|office|office365|office\\.net|live|sharepoint|outlook|onedrive|windows|azure|msauth|msftauth|microsoft365)\\.(com|net|cloud)$'))
| group lure_events = count(event.type = 'Process Creation'), lookalike_lookups = count(event.type = 'DNS Resolved'), first_seen = min(event.time), last_seen = max(event.time), host = any(endpoint.name) by agent.uuid, bucket = timebucket('15m')
| filter lure_events > 0 lookalike_lookups > 0
| sort -last_seen
| limit 2001 required field · View requirements
Required telemetry
- DeviceProcessEvents
Required fields
Timestamp: Event time
Readiness test
DeviceProcessEvents | where Timestamp > ago(1d) | project Timestamp | take 5
// HUNT: lure document open plus Microsoft-themed look-alike hostname lookup on one host within 15 minutes // SCHEMA PROFILE: microsoft-defender-xdr // MITRE: T1566.001, T1566.002, T1583.001 // CONF: medium | FP: medium // FALSE POSITIVES: SaaS vendors whose own domain pairs a login/auth prefix with a Microsoft product word, // EQUIVALENCE: unsupported-without-redesign - The card joins process creation and DNS lookups on one host in a time bucket. The daily KQL stage allows one source table per query, and the DNS half alone would duplicate the Q4 card. // REQUIRES: Defender for Endpoint process-creation telemetry (DeviceProcessEvents) and DNS events (DeviceEvents) // TUNING: Run the Q1 and Q4 KQL tabs and correlate the two result sets by DeviceId and time. // LOOKBACK: 14d on the CQL tab // CONFIGURATION: Use the CQL tab for this card. // KNOWN GAPS: The two-stage correlation by host and 15-minute bucket is not expressed in KQL. // VALIDATION LEVEL: static-reviewed
Q4 · DNS lookup matching the Microsoft-themed look-alike hostname chain
CONF MEDIUMFP MEDIUMCOST LOW
Looks for: Any managed endpoint resolving a hostname built from the chain ANY.RUN reports for the 173 kit domains, without needing a domain list. This survives domain rotation because it keys on the naming grammar, not the registered domain.
FP: legitimate vendor hostnames that combine these words, and security-awareness phishing simulations. Exclude your simulation vendor's domains and review the registered domain before escalating.
Validation: schema-aligned, static-reviewedAutomated: static-passedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
- PowerQuery: A lookup with no attributed process still matches, because only the name is tested.
- PowerQuery assumes: event.dns.request holds the queried name; some schema versions use dns.request instead, so confirm which is populated before trusting an empty result.
- PowerQuery assumes: src.process.name is the requesting process on a DNS Resolved event.
- KQL – Defender XDR: Hosts without DnsQueryResponse events in DeviceEvents are not covered.
- KQL – Defender XDR assumes: The queried name is under the DnsQueryString or QueryName key of AdditionalFields; which key a tenant populates is not documented, so the readiness test prints both.
// HUNT: DNS lookup of a hostname following the Skyw4lker Microsoft-themed look-alike chain // MITRE: T1583.001, T1566.002 | CONF: medium FP: medium COST: low // REQUIRES: Falcon DNS telemetry (DnsRequest) on managed endpoints // FALSE POSITIVES: phishing-simulation vendors, and SaaS hostnames that pair a login/auth prefix // with a Microsoft product word // TUNING: exclude your phishing-simulation vendor domains; allowlist confirmed-benign registered // domains after review; add the Microsoft-domain alternation for tenant vanity domains // Source: hostname chain pattern is the one ANY.RUN lists under URL patterns for this kit // LOOKBACK: 14d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context). #event_simpleName=DnsRequest | DomainName=/^(docshare|sdocshares|pdocshared|pdfdocshared|efaxdoc|reauth|statement|copilot|login|auth)[a-z0-9.-]*(outlook|onedrive|copilot|office365)/i | DomainName!=/(^|\.)(microsoft|microsoftonline|office|office365|office\.net|live|sharepoint|outlook|onedrive|windows|azure|msauth|msftauth|microsoft365)\.(com|net|cloud)$/i | table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName], limit=200) | sort(@timestamp, order=desc)
3 required fields · View requirements
Required telemetry
- DNS Resolved events
Required fields
event.type: Event typeevent.time: Event timeevent.dns.request: Queried name
Recommended fields
src.process.name: Requesting process
Fallbacks
endpoint.name→agent.uuid: Changes the displayed host identifier only.
Readiness test
event.type = 'DNS Resolved' event.dns.request = * | limit 5 | columns event.type, event.time, event.dns.request, src.process.name
// HUNT: DNS lookup of a hostname following the Skyw4lker Microsoft-themed look-alike chain // SCHEMA PROFILE: sentinelone-endpoint-ocsf // MITRE: T1583.001, T1566.002 // CONF: medium | FP: medium // FALSE POSITIVES: phishing-simulation vendors, and SaaS hostnames that pair a login/auth prefix // EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: a queried name following the look-alike chain, with Microsoft-owned registered domains excluded. matches is case-insensitive, which reproduces the CQL /i intent. // REQUIRES: SentinelOne DNS telemetry (DNS Resolved) with the requesting process // TUNING: Exclude your phishing-simulation vendor domains; allowlist confirmed-benign registered domains after review; add tenant vanity domains to the Microsoft alternation. // LOOKBACK: 14d; extend to 30d for the incident window // CONFIGURATION: No lookup objects required. // KNOWN GAPS: A lookup with no attributed process still matches, because only the name is tested. // VALIDATION LEVEL: static-reviewed event.type = 'DNS Resolved' event.dns.request matches '^(docshare|sdocshares|pdocshared|pdfdocshared|efaxdoc|reauth|statement|copilot|login|auth)[a-z0-9.-]*(outlook|onedrive|copilot|office365)' !(event.dns.request matches '(^|\\.)(microsoft|microsoftonline|office|office365|office\\.net|live|sharepoint|outlook|onedrive|windows|azure|msauth|msftauth|microsoft365)\\.(com|net|cloud)$') | sort -event.time | limit 200 | columns event.time, endpoint.name, src.process.user, event.dns.request, src.process.name
Automated validation: static-passed
Static schema: passed (0 errors, 0 warnings)
Positive fixtures: 0/0 · Benign fixtures: 0/0
Evidence: recorded in the build's validation report (not published)
Checked: 2026-10-28T11:40:00Z · siem-query-rosetta-kql-validator/1.0.0
3 required fields · View requirements
Required telemetry
- DeviceEvents (ActionType DnsQueryResponse)
Required fields
Timestamp: Event timeActionType: Action typeAdditionalFields: Event details
Recommended fields
InitiatingProcessFileName: Initiating process
Fallbacks
DeviceName→DeviceId: Changes the displayed host identifier only.
Readiness test
DeviceEvents | where Timestamp > ago(1d) | where ActionType == "DnsQueryResponse" | project Timestamp, ActionType, AdditionalFields | take 5
// HUNT: DNS lookup of a hostname following the Skyw4lker Microsoft-themed look-alike chain // SCHEMA PROFILE: microsoft-defender-xdr // MITRE: T1583.001, T1566.002 // CONF: medium | FP: medium // FALSE POSITIVES: phishing-simulation vendors, and SaaS hostnames that pair a login/auth prefix // EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate on the DnsQueryResponse action: the look-alike chain with Microsoft-owned registered domains excluded. DeviceNetworkEvents is not used because it is not DNS telemetry. // REQUIRES: Defender for Endpoint DNS events (DeviceEvents, ActionType DnsQueryResponse) // TUNING: Exclude your phishing-simulation vendor domains; allowlist confirmed-benign registered domains after review. // LOOKBACK: 14d; extend to 30d for the incident window // CONFIGURATION: No lookup objects required. // KNOWN GAPS: Hosts without DnsQueryResponse events in DeviceEvents are not covered. // VALIDATION LEVEL: schema-aligned // AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0 DeviceEvents | where Timestamp >= ago(14d) | where ActionType == "DnsQueryResponse" | extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"])) | where DnsName matches regex @"(?i)^(docshare|sdocshares|pdocshared|pdfdocshared|efaxdoc|reauth|statement|copilot|login|auth)[a-z0-9.-]*(outlook|onedrive|copilot|office365)" | where not(DnsName matches regex @"(?i)(^|\.)(microsoft|microsoftonline|office|office365|office\.net|live|sharepoint|outlook|onedrive|windows|azure|msauth|msftauth|microsoft365)\.(com|net|cloud)$") | project Timestamp, ReportId, DeviceId, DeviceName, DnsName, InitiatingProcessFileName | sort by Timestamp desc | take 200
Q5 · DNS lookup of reported Skyw4lker kit domains (part 1 of 2)
CONF HIGHFP LOWCOST LOW
Looks for: Resolution of the first 87 of the 173 kit-hosting domains in ANY.RUN's list, alphabetical, suffix-matched so any subdomain of a listed host also hits. The list is single-sourced to ANY.RUN and some entries look like compromised legitimate business sites, so a hit is strong evidence of a lookup, not proof of phishing on its own.
FP: low, but several entries are ordinary-looking company domains that may be compromised legitimate sites. Confirm with proxy logs for the kit URL grammar (section 7, N1) before declaring a victim.
Validation: schema-aligned, static-reviewedAutomated: static-passedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
- PowerQuery: Output is capped at 1,000 rows; narrow the window if the cap is reached.
- PowerQuery assumes: event.dns.request holds the queried name; some schema versions use dns.request instead, so confirm which is populated before trusting an empty result.
- PowerQuery assumes: src.process.name is the requesting process on a DNS Resolved event.
- KQL – Defender XDR: Hosts without DnsQueryResponse events in DeviceEvents are not covered.
- KQL – Defender XDR: Output is capped at 10,000 rows by the portal.
- KQL – Defender XDR assumes: The queried name is under the DnsQueryString or QueryName key of AdditionalFields; which key a tenant populates is not documented, so the readiness test prints both.
// HUNT: DNS resolution of reported Skyw4lker kit-hosting domains (part 1 of 2) // MITRE: T1583.001, T1566.002 | CONF: high FP: low COST: low // REQUIRES: Falcon DNS telemetry (DnsRequest) on managed endpoints // FALSE POSITIVES: low; some listed domains look like compromised legitimate sites, so a lookup is // not proof of phishing. Confirm the kit URL grammar in proxy logs before escalating // Source: ANY.RUN domain list (173 entries, single vendor source). Detect-only, never block // LOOKBACK: 30d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context). #event_simpleName=DnsRequest | DomainName=/(^|\.)(0350pvas\.acs-wcst\.com|0ff365access\.mooo\.com|0utlook0ffice365admin\.twilightparadox\.com|1355bcra\.ck29material\.com|1717emxr\.acs-wcst\.com|5200m\.com|5375jngu\.prefform\.us|6662nyde\.acs-wcst\.com|6695lkmo\.prefform\.us|7301eqny\.acs-wcst\.com|7criccasinobonus\.cc|aachem-za\.co|accordhealth\.cc|acrobat-adobe-com-4464uswc\.egllo\.com|advancedsteelbuilding\.com|alasilla\.com|albertamo\.com|alfabricationinc\.com|apexpartsdepot\.com|apinows\.com|atlantictriad\.ignorelist\.com|atlassgroupinc\.com|auth-loadingdocuments\.online|auth\.login\.office365\.cloud\.onedrive\.outlook\.atlarchitacts\.com|authorize\.copilot\.outlook\.common\.microsoft0365\.atlarchitacts\.com|awemode\.outlookoffice365\.microsoftcopilots\.docshare\.linnwest\.us|azgymfloor\.com|bandg-electrics\.com|bennett002\.mooo\.com|bezpartien\.online|bigbrain\.chickenkiller\.com|bloomfleldcapital\.com|bramum\.online|buckslu\.org|bxcelcounselling\.org|caine-wenier\.com|calebchemicals\.com|calmechc\.net|canacedesotogroup\.com|celestialtremor\.org|celliottelliott-wellman\.org|celvarioncorn\.org|centipedtourspa\.com|claronevents\.com|cleggs\.my03\.com|clingard\.pro|clubdenut\.club|copilot\.login\.office365outlook\.cloud\.onedrive\.atlarchitacts\.com|copilots\.outlook\.cloud\.microsoft\.andersonelevators\.com|copilots\.outlook\.cloud\.microsoft\.syrosconstructlon\.com|coreansdmain\.com|csr-rooflng\.com|ctr-wooding\.com|darap-it\.co|detroitgardenswork\.com|devtachsales\.com|dguidrycardinazprofessional\.com|docshare\.auth\.copilot\.outlook\.onedrive\.common\.earthlink-net\.com|docshare\.auth\.copilot\.outlook\.onedrive\.common\.evergreenerg\.com|docshare\.auth\.copilot\.outlook\.onedrive\.common\.northemheating\.com|docshare\.auth\.copilot\.outlook\.onedrive\.common0\.evergreenerg\.com|docshare\.auth\.copilot\.outlookonedrive\.common\.northemheating\.com|docshare\.auth2026\.onedrive\.outlooksdocument\.csr-rooflng\.com|docshares\.auth2026\.outlookcommon\.copilots\.commm\.csr-rooflng\.com|document\.akiflx\.com|dpincoli\.com|dutchfarrms\.com|eccentric-authentication\.com|ecosys\.newdocument2026\.pdfdocshared\.tntileandmarbleinc\.com|efaxdoc\.auth\.login\.outlook\.office365\.tescoccontrols\.com|efaxdoc\.auth\.outlook2026common\.copilos26\.bettylnc\.com|efaxdoc\.auth\.outlook2026common\.copilos26\.ikextal-co-kr\.com|efaxdoc\.auth\.outlook2026common\.copilos26\.kone-inc\.com|efaxdoc\.documents2026\.cmc\.docs\.shared\.matchlinemechanicallc\.com|efaxdoc\.documents2026\.docs\.shared\.lakeviewscustom\.com|eurosforgroup\.com|flow505\.mooo\.com|flow55\.chickenkiller\.com|fosterswifts\.com|frontdesk\.click|gcotoncovingtoncontracting\.com|ghethim\.com|glafondbottamconstruction\.com|globlasumi\.com|gregor\.justdied\.com|grincool\.xyz|haevy-llc\.com)$/i | table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName], limit=max) | sort(@timestamp, order=desc)
3 required fields · View requirements
Required telemetry
- DNS Resolved events
Required fields
event.type: Event typeevent.time: Event timeevent.dns.request: Queried name
Recommended fields
src.process.name: Requesting process
Fallbacks
endpoint.name→agent.uuid: Changes the displayed host identifier only.
Readiness test
event.type = 'DNS Resolved' event.dns.request = * | limit 5 | columns event.type, event.time, event.dns.request, src.process.name
// HUNT: DNS resolution of reported Skyw4lker kit-hosting domains (part 1 of 2) // SCHEMA PROFILE: sentinelone-endpoint-ocsf // MITRE: T1583.001, T1566.002 // CONF: high | FP: low // FALSE POSITIVES: low; some listed domains look like compromised legitimate sites, so a lookup is // EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: a lookup of any listed kit domain or a subdomain of it, with the dot boundary kept. The CQL has no row limit; PowerQuery caps output at 1,000 rows. // REQUIRES: SentinelOne DNS telemetry (DNS Resolved) with the requesting process // TUNING: A lookup is not proof of phishing because some listed domains look like compromised legitimate sites; confirm the kit URL grammar in proxy logs before escalating. Detect only, never block. // LOOKBACK: 30d; extend as the incident requires // CONFIGURATION: No lookup objects required. // KNOWN GAPS: Output is capped at 1,000 rows; narrow the window if the cap is reached. // VALIDATION LEVEL: static-reviewed event.type = 'DNS Resolved' event.dns.request matches '(^|\\.)(0350pvas\\.acs-wcst\\.com|0ff365access\\.mooo\\.com|0utlook0ffice365admin\\.twilightparadox\\.com|1355bcra\\.ck29material\\.com|1717emxr\\.acs-wcst\\.com|5200m\\.com|5375jngu\\.prefform\\.us|6662nyde\\.acs-wcst\\.com|6695lkmo\\.prefform\\.us|7301eqny\\.acs-wcst\\.com|7criccasinobonus\\.cc|aachem-za\\.co|accordhealth\\.cc|acrobat-adobe-com-4464uswc\\.egllo\\.com|advancedsteelbuilding\\.com|alasilla\\.com|albertamo\\.com|alfabricationinc\\.com|apexpartsdepot\\.com|apinows\\.com|atlantictriad\\.ignorelist\\.com|atlassgroupinc\\.com|auth-loadingdocuments\\.online|auth\\.login\\.office365\\.cloud\\.onedrive\\.outlook\\.atlarchitacts\\.com|authorize\\.copilot\\.outlook\\.common\\.microsoft0365\\.atlarchitacts\\.com|awemode\\.outlookoffice365\\.microsoftcopilots\\.docshare\\.linnwest\\.us|azgymfloor\\.com|bandg-electrics\\.com|bennett002\\.mooo\\.com|bezpartien\\.online|bigbrain\\.chickenkiller\\.com|bloomfleldcapital\\.com|bramum\\.online|buckslu\\.org|bxcelcounselling\\.org|caine-wenier\\.com|calebchemicals\\.com|calmechc\\.net|canacedesotogroup\\.com|celestialtremor\\.org|celliottelliott-wellman\\.org|celvarioncorn\\.org|centipedtourspa\\.com|claronevents\\.com|cleggs\\.my03\\.com|clingard\\.pro|clubdenut\\.club|copilot\\.login\\.office365outlook\\.cloud\\.onedrive\\.atlarchitacts\\.com|copilots\\.outlook\\.cloud\\.microsoft\\.andersonelevators\\.com|copilots\\.outlook\\.cloud\\.microsoft\\.syrosconstructlon\\.com|coreansdmain\\.com|csr-rooflng\\.com|ctr-wooding\\.com|darap-it\\.co|detroitgardenswork\\.com|devtachsales\\.com|dguidrycardinazprofessional\\.com|docshare\\.auth\\.copilot\\.outlook\\.onedrive\\.common\\.earthlink-net\\.com|docshare\\.auth\\.copilot\\.outlook\\.onedrive\\.common\\.evergreenerg\\.com|docshare\\.auth\\.copilot\\.outlook\\.onedrive\\.common\\.northemheating\\.com|docshare\\.auth\\.copilot\\.outlook\\.onedrive\\.common0\\.evergreenerg\\.com|docshare\\.auth\\.copilot\\.outlookonedrive\\.common\\.northemheating\\.com|docshare\\.auth2026\\.onedrive\\.outlooksdocument\\.csr-rooflng\\.com|docshares\\.auth2026\\.outlookcommon\\.copilots\\.commm\\.csr-rooflng\\.com|document\\.akiflx\\.com|dpincoli\\.com|dutchfarrms\\.com|eccentric-authentication\\.com|ecosys\\.newdocument2026\\.pdfdocshared\\.tntileandmarbleinc\\.com|efaxdoc\\.auth\\.login\\.outlook\\.office365\\.tescoccontrols\\.com|efaxdoc\\.auth\\.outlook2026common\\.copilos26\\.bettylnc\\.com|efaxdoc\\.auth\\.outlook2026common\\.copilos26\\.ikextal-co-kr\\.com|efaxdoc\\.auth\\.outlook2026common\\.copilos26\\.kone-inc\\.com|efaxdoc\\.documents2026\\.cmc\\.docs\\.shared\\.matchlinemechanicallc\\.com|efaxdoc\\.documents2026\\.docs\\.shared\\.lakeviewscustom\\.com|eurosforgroup\\.com|flow505\\.mooo\\.com|flow55\\.chickenkiller\\.com|fosterswifts\\.com|frontdesk\\.click|gcotoncovingtoncontracting\\.com|ghethim\\.com|glafondbottamconstruction\\.com|globlasumi\\.com|gregor\\.justdied\\.com|grincool\\.xyz|haevy-llc\\.com)$' | sort -event.time | limit 1000 | columns event.time, endpoint.name, src.process.user, event.dns.request, src.process.name
Automated validation: static-passed
Static schema: passed (0 errors, 0 warnings)
Positive fixtures: 0/0 · Benign fixtures: 0/0
Evidence: recorded in the build's validation report (not published)
Checked: 2026-10-28T11:40:00Z · siem-query-rosetta-kql-validator/1.0.0
3 required fields · View requirements
Required telemetry
- DeviceEvents (ActionType DnsQueryResponse)
Required fields
Timestamp: Event timeActionType: Action typeAdditionalFields: Event details
Recommended fields
InitiatingProcessFileName: Initiating process
Fallbacks
DeviceName→DeviceId: Changes the displayed host identifier only.
Readiness test
DeviceEvents | where Timestamp > ago(1d) | where ActionType == "DnsQueryResponse" | project Timestamp, ActionType, AdditionalFields | take 5
// HUNT: DNS resolution of reported Skyw4lker kit-hosting domains (part 1 of 2) // SCHEMA PROFILE: microsoft-defender-xdr // MITRE: T1583.001, T1566.002 // CONF: high | FP: low // FALSE POSITIVES: low; some listed domains look like compromised legitimate sites, so a lookup is // EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate on the DnsQueryResponse action: any listed kit domain or a subdomain of it, with the dot boundary kept. The CQL has no row limit; the portal returns at most 10,000 rows. // REQUIRES: Defender for Endpoint DNS events (DeviceEvents, ActionType DnsQueryResponse) // TUNING: A lookup is not proof of phishing because some listed domains look like compromised legitimate sites; confirm the kit URL grammar in proxy logs before escalating. Detect only, never block. // LOOKBACK: 30d (Advanced Hunting retention equals the CQL window) // CONFIGURATION: No lookup objects required. // KNOWN GAPS: Hosts without DnsQueryResponse events in DeviceEvents are not covered. Output is capped at 10,000 rows by the portal. // VALIDATION LEVEL: schema-aligned // AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0 DeviceEvents | where Timestamp >= ago(30d) | where ActionType == "DnsQueryResponse" | extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"])) | where DnsName matches regex @"(?i)(^|\.)(0350pvas\.acs-wcst\.com|0ff365access\.mooo\.com|0utlook0ffice365admin\.twilightparadox\.com|1355bcra\.ck29material\.com|1717emxr\.acs-wcst\.com|5200m\.com|5375jngu\.prefform\.us|6662nyde\.acs-wcst\.com|6695lkmo\.prefform\.us|7301eqny\.acs-wcst\.com|7criccasinobonus\.cc|aachem-za\.co|accordhealth\.cc|acrobat-adobe-com-4464uswc\.egllo\.com|advancedsteelbuilding\.com|alasilla\.com|albertamo\.com|alfabricationinc\.com|apexpartsdepot\.com|apinows\.com|atlantictriad\.ignorelist\.com|atlassgroupinc\.com|auth-loadingdocuments\.online|auth\.login\.office365\.cloud\.onedrive\.outlook\.atlarchitacts\.com|authorize\.copilot\.outlook\.common\.microsoft0365\.atlarchitacts\.com|awemode\.outlookoffice365\.microsoftcopilots\.docshare\.linnwest\.us|azgymfloor\.com|bandg-electrics\.com|bennett002\.mooo\.com|bezpartien\.online|bigbrain\.chickenkiller\.com|bloomfleldcapital\.com|bramum\.online|buckslu\.org|bxcelcounselling\.org|caine-wenier\.com|calebchemicals\.com|calmechc\.net|canacedesotogroup\.com|celestialtremor\.org|celliottelliott-wellman\.org|celvarioncorn\.org|centipedtourspa\.com|claronevents\.com|cleggs\.my03\.com|clingard\.pro|clubdenut\.club|copilot\.login\.office365outlook\.cloud\.onedrive\.atlarchitacts\.com|copilots\.outlook\.cloud\.microsoft\.andersonelevators\.com|copilots\.outlook\.cloud\.microsoft\.syrosconstructlon\.com|coreansdmain\.com|csr-rooflng\.com|ctr-wooding\.com|darap-it\.co|detroitgardenswork\.com|devtachsales\.com|dguidrycardinazprofessional\.com|docshare\.auth\.copilot\.outlook\.onedrive\.common\.earthlink-net\.com|docshare\.auth\.copilot\.outlook\.onedrive\.common\.evergreenerg\.com|docshare\.auth\.copilot\.outlook\.onedrive\.common\.northemheating\.com|docshare\.auth\.copilot\.outlook\.onedrive\.common0\.evergreenerg\.com|docshare\.auth\.copilot\.outlookonedrive\.common\.northemheating\.com|docshare\.auth2026\.onedrive\.outlooksdocument\.csr-rooflng\.com|docshares\.auth2026\.outlookcommon\.copilots\.commm\.csr-rooflng\.com|document\.akiflx\.com|dpincoli\.com|dutchfarrms\.com|eccentric-authentication\.com|ecosys\.newdocument2026\.pdfdocshared\.tntileandmarbleinc\.com|efaxdoc\.auth\.login\.outlook\.office365\.tescoccontrols\.com|efaxdoc\.auth\.outlook2026common\.copilos26\.bettylnc\.com|efaxdoc\.auth\.outlook2026common\.copilos26\.ikextal-co-kr\.com|efaxdoc\.auth\.outlook2026common\.copilos26\.kone-inc\.com|efaxdoc\.documents2026\.cmc\.docs\.shared\.matchlinemechanicallc\.com|efaxdoc\.documents2026\.docs\.shared\.lakeviewscustom\.com|eurosforgroup\.com|flow505\.mooo\.com|flow55\.chickenkiller\.com|fosterswifts\.com|frontdesk\.click|gcotoncovingtoncontracting\.com|ghethim\.com|glafondbottamconstruction\.com|globlasumi\.com|gregor\.justdied\.com|grincool\.xyz|haevy-llc\.com)$" | project Timestamp, ReportId, DeviceId, DeviceName, DnsName, InitiatingProcessFileName | sort by Timestamp desc | take 10000
Q6 · DNS lookup of reported Skyw4lker kit domains (part 2 of 2)
CONF HIGHFP LOWCOST LOW
Looks for: The remaining 86 domains from ANY.RUN's list. Split in two so the Open in Falcon link stays under typical request-size limits.
FP: low, with the same compromised-legitimate-site caveat as part 1.
Validation: schema-aligned, static-reviewedAutomated: static-passedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
- PowerQuery: Output is capped at 1,000 rows; narrow the window if the cap is reached.
- PowerQuery assumes: event.dns.request holds the queried name; some schema versions use dns.request instead, so confirm which is populated before trusting an empty result.
- PowerQuery assumes: src.process.name is the requesting process on a DNS Resolved event.
- KQL – Defender XDR: Hosts without DnsQueryResponse events in DeviceEvents are not covered.
- KQL – Defender XDR: Output is capped at 10,000 rows by the portal.
- KQL – Defender XDR assumes: The queried name is under the DnsQueryString or QueryName key of AdditionalFields; which key a tenant populates is not documented, so the readiness test prints both.
// HUNT: DNS resolution of reported Skyw4lker kit-hosting domains (part 2 of 2) // MITRE: T1583.001, T1566.002 | CONF: high FP: low COST: low // REQUIRES: Falcon DNS telemetry (DnsRequest) on managed endpoints // FALSE POSITIVES: low; some listed domains look like compromised legitimate sites, so a lookup is // not proof of phishing. Confirm the kit URL grammar in proxy logs before escalating // Source: ANY.RUN domain list (173 entries, single vendor source). Detect-only, never block // LOOKBACK: 30d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context). #event_simpleName=DnsRequest | DomainName=/(^|\.)(hcnyecom\.com|hivezoom\.com|ideahom\.world|incommecialre\.com|innvisoin\.net|insigthinvestments\.com|investomind\.biz|jacobpwpinc\.org|jjnysnobiogtx\.org|kilishy\.qhigh\.com|kuer\.online|lampadasdeslgn\.com|lawyer\.cuztools\.com|lifetimeroofsystem\.net|linking\.mefound\.com|linogomes-pt\.cc|lionheartsecurityservice\.com|liyuda\.com|login\.microsoft365\.outlook\.copilotsoffice365\.lntactpr\.com|login\.office365outlooks\.microsoft\.cloud-outlook\.naregruop\.com|m365cloud\.login\.outlook\.office365\.azgymfloor\.com|maqaigiapelhani\.cam|metlarnelaw\.com|metrorocl\.co\.uk|mgproparties\.com|minda-mo\.com|mouphyweb\.com|naregruop\.com|nicewayrealestate\.cc|noxband\.com|off365acess\.jumpingcrab\.com|off365mail\.club|office0365login\.2waky\.com|outlookdrive\.microsoftonline\.common\.oauth2\.client\.buycerm\.com|outlookoffice365\.microsoftcopilots\.vigilantlnc\.com|paulecosconnect\.com|payapp\.auth\.outlook2026common\.copilos26\.bettylnc\.com|pdfdocshared\.auth\.outlook2026common\.copilos26\.ikextal-co-kr\.com|pdlhaelth\.com|pdocshared\.documents2026\.docs\.shared\.ecmholdlnggroup\.com|pdocshared\.payments2026\.outlooks\.common\.ecmholdlnggroup\.com|photosofus\.com|plusoptlx\.com|priorispace\.biz|psionicsandhorses\.net|rapid-scale\.net|reauth\.copilot\.auth\.outlook\.mcloud365\.buycerm\.com|reauth\.copilot\.auth\.outlook\.mcloud365\.myhalnc\.com|reauth\.copilot\.common\.outlook\.mcloud365\.atlarchitacts\.com|reauth\.docs\.copilot\.auth02\.outlook\.mcloud365\.argentventuras\.com|rektham\.online|rubinsrudman\.com|rustlnsurance\.com|sdocshares\.auth\.outlook\.copilos26\.general\.csr-rooflng\.com|sdocshares\.auth\.outlook2026common\.copilos26\.csr-rooflng\.com|sdocshares\.authoutlooks\.common\.copilots2026\.hathormson\.com|seatacsmarine\.com|sedocs\.docs\.payrol2026\.common\.copilots2026\.vatrarnsformer\.com|shared\.paymentsclouds\.statementsapproved\.jetbusinesscapltal\.com|slybee\.com|snk-s\.org|solutions00fileptroduct\.com|sorensenmaysflower\.blog|statement\.docdriveoauth\.authorized\.copilot\.syrosconstructlon\.com|statement\.outlookoffice365\.microsoftcopilots\.calmechc\.net|statements\.outlook\.office365microsoft\.payment\.run\.stoneclty\.com|stellarntis-fs\.com|studeseliamechan\.link|sunraycontractlng\.com|sunstateaquips\.com|swiftii\.chickenkiller\.com|tentkit\.com|thepaybank\.com|thewiginton\.com|topcoatmetalsfinishing\.com|toplinebuy\.com|torvion\.life|unitadrentals\.com|unitedwirescompany\.com|us-agricultures\.com|vasquezmyth\.com|westlakeproduces\.com|whitfillsnursery\.com|wsochares\.authpayments\.common\.paid2026\.bullochdirtwroks\.com|wwriwashingtonenergy\.com|zrs-wooding\.com)$/i | table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName], limit=max) | sort(@timestamp, order=desc)
3 required fields · View requirements
Required telemetry
- DNS Resolved events
Required fields
event.type: Event typeevent.time: Event timeevent.dns.request: Queried name
Recommended fields
src.process.name: Requesting process
Fallbacks
endpoint.name→agent.uuid: Changes the displayed host identifier only.
Readiness test
event.type = 'DNS Resolved' event.dns.request = * | limit 5 | columns event.type, event.time, event.dns.request, src.process.name
// HUNT: DNS resolution of reported Skyw4lker kit-hosting domains (part 2 of 2) // SCHEMA PROFILE: sentinelone-endpoint-ocsf // MITRE: T1583.001, T1566.002 // CONF: high | FP: low // FALSE POSITIVES: low; some listed domains look like compromised legitimate sites, so a lookup is // EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate: a lookup of any listed kit domain or a subdomain of it, with the dot boundary kept. The CQL has no row limit; PowerQuery caps output at 1,000 rows. // REQUIRES: SentinelOne DNS telemetry (DNS Resolved) with the requesting process // TUNING: A lookup is not proof of phishing because some listed domains look like compromised legitimate sites; confirm the kit URL grammar in proxy logs before escalating. Detect only, never block. // LOOKBACK: 30d; extend as the incident requires // CONFIGURATION: No lookup objects required. // KNOWN GAPS: Output is capped at 1,000 rows; narrow the window if the cap is reached. // VALIDATION LEVEL: static-reviewed event.type = 'DNS Resolved' event.dns.request matches '(^|\\.)(hcnyecom\\.com|hivezoom\\.com|ideahom\\.world|incommecialre\\.com|innvisoin\\.net|insigthinvestments\\.com|investomind\\.biz|jacobpwpinc\\.org|jjnysnobiogtx\\.org|kilishy\\.qhigh\\.com|kuer\\.online|lampadasdeslgn\\.com|lawyer\\.cuztools\\.com|lifetimeroofsystem\\.net|linking\\.mefound\\.com|linogomes-pt\\.cc|lionheartsecurityservice\\.com|liyuda\\.com|login\\.microsoft365\\.outlook\\.copilotsoffice365\\.lntactpr\\.com|login\\.office365outlooks\\.microsoft\\.cloud-outlook\\.naregruop\\.com|m365cloud\\.login\\.outlook\\.office365\\.azgymfloor\\.com|maqaigiapelhani\\.cam|metlarnelaw\\.com|metrorocl\\.co\\.uk|mgproparties\\.com|minda-mo\\.com|mouphyweb\\.com|naregruop\\.com|nicewayrealestate\\.cc|noxband\\.com|off365acess\\.jumpingcrab\\.com|off365mail\\.club|office0365login\\.2waky\\.com|outlookdrive\\.microsoftonline\\.common\\.oauth2\\.client\\.buycerm\\.com|outlookoffice365\\.microsoftcopilots\\.vigilantlnc\\.com|paulecosconnect\\.com|payapp\\.auth\\.outlook2026common\\.copilos26\\.bettylnc\\.com|pdfdocshared\\.auth\\.outlook2026common\\.copilos26\\.ikextal-co-kr\\.com|pdlhaelth\\.com|pdocshared\\.documents2026\\.docs\\.shared\\.ecmholdlnggroup\\.com|pdocshared\\.payments2026\\.outlooks\\.common\\.ecmholdlnggroup\\.com|photosofus\\.com|plusoptlx\\.com|priorispace\\.biz|psionicsandhorses\\.net|rapid-scale\\.net|reauth\\.copilot\\.auth\\.outlook\\.mcloud365\\.buycerm\\.com|reauth\\.copilot\\.auth\\.outlook\\.mcloud365\\.myhalnc\\.com|reauth\\.copilot\\.common\\.outlook\\.mcloud365\\.atlarchitacts\\.com|reauth\\.docs\\.copilot\\.auth02\\.outlook\\.mcloud365\\.argentventuras\\.com|rektham\\.online|rubinsrudman\\.com|rustlnsurance\\.com|sdocshares\\.auth\\.outlook\\.copilos26\\.general\\.csr-rooflng\\.com|sdocshares\\.auth\\.outlook2026common\\.copilos26\\.csr-rooflng\\.com|sdocshares\\.authoutlooks\\.common\\.copilots2026\\.hathormson\\.com|seatacsmarine\\.com|sedocs\\.docs\\.payrol2026\\.common\\.copilots2026\\.vatrarnsformer\\.com|shared\\.paymentsclouds\\.statementsapproved\\.jetbusinesscapltal\\.com|slybee\\.com|snk-s\\.org|solutions00fileptroduct\\.com|sorensenmaysflower\\.blog|statement\\.docdriveoauth\\.authorized\\.copilot\\.syrosconstructlon\\.com|statement\\.outlookoffice365\\.microsoftcopilots\\.calmechc\\.net|statements\\.outlook\\.office365microsoft\\.payment\\.run\\.stoneclty\\.com|stellarntis-fs\\.com|studeseliamechan\\.link|sunraycontractlng\\.com|sunstateaquips\\.com|swiftii\\.chickenkiller\\.com|tentkit\\.com|thepaybank\\.com|thewiginton\\.com|topcoatmetalsfinishing\\.com|toplinebuy\\.com|torvion\\.life|unitadrentals\\.com|unitedwirescompany\\.com|us-agricultures\\.com|vasquezmyth\\.com|westlakeproduces\\.com|whitfillsnursery\\.com|wsochares\\.authpayments\\.common\\.paid2026\\.bullochdirtwroks\\.com|wwriwashingtonenergy\\.com|zrs-wooding\\.com)$' | sort -event.time | limit 1000 | columns event.time, endpoint.name, src.process.user, event.dns.request, src.process.name
Automated validation: static-passed
Static schema: passed (0 errors, 0 warnings)
Positive fixtures: 0/0 · Benign fixtures: 0/0
Evidence: recorded in the build's validation report (not published)
Checked: 2026-10-28T11:40:00Z · siem-query-rosetta-kql-validator/1.0.0
3 required fields · View requirements
Required telemetry
- DeviceEvents (ActionType DnsQueryResponse)
Required fields
Timestamp: Event timeActionType: Action typeAdditionalFields: Event details
Recommended fields
InitiatingProcessFileName: Initiating process
Fallbacks
DeviceName→DeviceId: Changes the displayed host identifier only.
Readiness test
DeviceEvents | where Timestamp > ago(1d) | where ActionType == "DnsQueryResponse" | project Timestamp, ActionType, AdditionalFields | take 5
// HUNT: DNS resolution of reported Skyw4lker kit-hosting domains (part 2 of 2) // SCHEMA PROFILE: microsoft-defender-xdr // MITRE: T1583.001, T1566.002 // CONF: high | FP: low // FALSE POSITIVES: low; some listed domains look like compromised legitimate sites, so a lookup is // EQUIVALENCE: equivalent-with-schema-assumptions - Same DNS predicate on the DnsQueryResponse action: any listed kit domain or a subdomain of it, with the dot boundary kept. The CQL has no row limit; the portal returns at most 10,000 rows. // REQUIRES: Defender for Endpoint DNS events (DeviceEvents, ActionType DnsQueryResponse) // TUNING: A lookup is not proof of phishing because some listed domains look like compromised legitimate sites; confirm the kit URL grammar in proxy logs before escalating. Detect only, never block. // LOOKBACK: 30d (Advanced Hunting retention equals the CQL window) // CONFIGURATION: No lookup objects required. // KNOWN GAPS: Hosts without DnsQueryResponse events in DeviceEvents are not covered. Output is capped at 10,000 rows by the portal. // VALIDATION LEVEL: schema-aligned // AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0 DeviceEvents | where Timestamp >= ago(30d) | where ActionType == "DnsQueryResponse" | extend DnsName = tostring(coalesce(parse_json(AdditionalFields)["DnsQueryString"], parse_json(AdditionalFields)["QueryName"])) | where DnsName matches regex @"(?i)(^|\.)(hcnyecom\.com|hivezoom\.com|ideahom\.world|incommecialre\.com|innvisoin\.net|insigthinvestments\.com|investomind\.biz|jacobpwpinc\.org|jjnysnobiogtx\.org|kilishy\.qhigh\.com|kuer\.online|lampadasdeslgn\.com|lawyer\.cuztools\.com|lifetimeroofsystem\.net|linking\.mefound\.com|linogomes-pt\.cc|lionheartsecurityservice\.com|liyuda\.com|login\.microsoft365\.outlook\.copilotsoffice365\.lntactpr\.com|login\.office365outlooks\.microsoft\.cloud-outlook\.naregruop\.com|m365cloud\.login\.outlook\.office365\.azgymfloor\.com|maqaigiapelhani\.cam|metlarnelaw\.com|metrorocl\.co\.uk|mgproparties\.com|minda-mo\.com|mouphyweb\.com|naregruop\.com|nicewayrealestate\.cc|noxband\.com|off365acess\.jumpingcrab\.com|off365mail\.club|office0365login\.2waky\.com|outlookdrive\.microsoftonline\.common\.oauth2\.client\.buycerm\.com|outlookoffice365\.microsoftcopilots\.vigilantlnc\.com|paulecosconnect\.com|payapp\.auth\.outlook2026common\.copilos26\.bettylnc\.com|pdfdocshared\.auth\.outlook2026common\.copilos26\.ikextal-co-kr\.com|pdlhaelth\.com|pdocshared\.documents2026\.docs\.shared\.ecmholdlnggroup\.com|pdocshared\.payments2026\.outlooks\.common\.ecmholdlnggroup\.com|photosofus\.com|plusoptlx\.com|priorispace\.biz|psionicsandhorses\.net|rapid-scale\.net|reauth\.copilot\.auth\.outlook\.mcloud365\.buycerm\.com|reauth\.copilot\.auth\.outlook\.mcloud365\.myhalnc\.com|reauth\.copilot\.common\.outlook\.mcloud365\.atlarchitacts\.com|reauth\.docs\.copilot\.auth02\.outlook\.mcloud365\.argentventuras\.com|rektham\.online|rubinsrudman\.com|rustlnsurance\.com|sdocshares\.auth\.outlook\.copilos26\.general\.csr-rooflng\.com|sdocshares\.auth\.outlook2026common\.copilos26\.csr-rooflng\.com|sdocshares\.authoutlooks\.common\.copilots2026\.hathormson\.com|seatacsmarine\.com|sedocs\.docs\.payrol2026\.common\.copilots2026\.vatrarnsformer\.com|shared\.paymentsclouds\.statementsapproved\.jetbusinesscapltal\.com|slybee\.com|snk-s\.org|solutions00fileptroduct\.com|sorensenmaysflower\.blog|statement\.docdriveoauth\.authorized\.copilot\.syrosconstructlon\.com|statement\.outlookoffice365\.microsoftcopilots\.calmechc\.net|statements\.outlook\.office365microsoft\.payment\.run\.stoneclty\.com|stellarntis-fs\.com|studeseliamechan\.link|sunraycontractlng\.com|sunstateaquips\.com|swiftii\.chickenkiller\.com|tentkit\.com|thepaybank\.com|thewiginton\.com|topcoatmetalsfinishing\.com|toplinebuy\.com|torvion\.life|unitadrentals\.com|unitedwirescompany\.com|us-agricultures\.com|vasquezmyth\.com|westlakeproduces\.com|whitfillsnursery\.com|wsochares\.authpayments\.common\.paid2026\.bullochdirtwroks\.com|wwriwashingtonenergy\.com|zrs-wooding\.com)$" | project Timestamp, ReportId, DeviceId, DeviceName, DnsName, InitiatingProcessFileName | sort by Timestamp desc | take 10000
Q7 · Endpoint connections to reported Skyw4lker backend IPs
CONF MEDIUMFP MEDIUMCOST LOW
Looks for: Outbound IPv4 connections to the two DigitalOcean backend addresses and the address ANY.RUN reports as shared with Gabagool. DigitalOcean space is rented VPS capacity that is reassigned over time, and the shared address also hosts a listed domain, so treat hits as hunt-grade and confirm with DNS (Q5, Q6) or proxy logs.
FP: VPS addresses are reassigned, so a connection months after the sighting window can be an unrelated tenant. Compare the hit date to ANY.RUN's observation window (June to October 2026) and pair with a Q5/Q6 domain hit on the same host.
Validation: schema-aligned, static-reviewedAutomated: static-passedEquivalence: equivalent-with-schema-assumptionsProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
- PowerQuery: Reassigned VPS addresses can produce unrelated hits.
- PowerQuery: Output is capped at 1,000 rows.
- PowerQuery assumes: dst.ip.address is the remote address on an IP Connect event and src.process.name is the connecting process.
- KQL – Defender XDR: Reassigned VPS addresses can produce unrelated hits.
- KQL – Defender XDR: Output is capped at 10,000 rows by the portal.
- KQL – Defender XDR assumes: RemoteIP holds the destination address for outbound connections.
// HUNT: endpoint connections to reported Skyw4lker backend IPs (two DigitalOcean, one shared with Gabagool) // MITRE: T1583.003, T1566.002 | CONF: medium FP: medium COST: low // REQUIRES: Falcon network telemetry (NetworkConnectIP4) // FALSE POSITIVES: reassigned VPS addresses; the shared Gabagool address also serves a listed domain // TUNING: keep only hits inside or shortly after ANY.RUN's June-October 2026 window, or hits on a host // that also appears in Q5/Q6 or Q2; exclude connections from non-browser server processes // Source: ANY.RUN reports these three addresses (single vendor source). Detect-only, never block // LOOKBACK: 30d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context). #event_simpleName=NetworkConnectIP4 | in(RemoteAddressIP4, values=["162.243.64.121", "67.205.154.32", "172.86.85.51"]) | table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, LocalAddressIP4, RemoteAddressIP4, RemotePort], limit=max) | sort(@timestamp, order=desc)
3 required fields · View requirements
Required telemetry
- IP Connect events
Required fields
event.type: Event typeevent.time: Event timedst.ip.address: Remote address
Recommended fields
src.process.name: Connecting process
Fallbacks
endpoint.name→agent.uuid: Changes the displayed host identifier only.
Readiness test
event.type = 'IP Connect' dst.ip.address = * | limit 5 | columns event.type, event.time, dst.ip.address, dst.port.number, src.process.name
// HUNT: endpoint connections to reported Skyw4lker backend IPs (two DigitalOcean, one shared with Gabagool)
// SCHEMA PROFILE: sentinelone-endpoint-ocsf
// MITRE: T1583.003, T1566.002
// CONF: medium | FP: medium
// FALSE POSITIVES: reassigned VPS addresses; the shared Gabagool address also serves a listed domain
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate: an outbound connection to one of the three reported backend addresses. The CQL has no row limit; PowerQuery caps output at 1,000 rows.
// REQUIRES: SentinelOne network telemetry (IP Connect) with the connecting process
// TUNING: Keep only hits inside or shortly after the reported June to October 2026 window, or on a host that also appears in Q5, Q6 or Q2; exclude connections from non-browser server processes. Detect only, never block.
// LOOKBACK: 30d; extend as the incident requires
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Reassigned VPS addresses can produce unrelated hits. Output is capped at 1,000 rows.
// VALIDATION LEVEL: static-reviewed
event.type = 'IP Connect' dst.ip.address in ('162.243.64.121', '67.205.154.32', '172.86.85.51')
| sort -event.time
| limit 1000
| columns event.time, endpoint.name, src.process.user, src.process.name, src.ip.address, dst.ip.address, dst.port.numberAutomated validation: static-passed
Static schema: passed (0 errors, 0 warnings)
Positive fixtures: 0/0 · Benign fixtures: 0/0
Evidence: recorded in the build's validation report (not published)
Checked: 2026-10-28T11:40:00Z · siem-query-rosetta-kql-validator/1.0.0
2 required fields · View requirements
Required telemetry
- DeviceNetworkEvents
Required fields
Timestamp: Event timeRemoteIP: Remote address
Recommended fields
InitiatingProcessFileName: Initiating process
Fallbacks
DeviceName→DeviceId: Changes the displayed host identifier only.
Readiness test
DeviceNetworkEvents | where Timestamp > ago(1d) | project Timestamp, RemoteIP, RemotePort | take 5
// HUNT: endpoint connections to reported Skyw4lker backend IPs (two DigitalOcean, one shared with Gabagool)
// SCHEMA PROFILE: microsoft-defender-xdr
// MITRE: T1583.003, T1566.002
// CONF: medium | FP: medium
// FALSE POSITIVES: reassigned VPS addresses; the shared Gabagool address also serves a listed domain
// EQUIVALENCE: equivalent-with-schema-assumptions - Same network predicate on DeviceNetworkEvents: a connection whose remote address is one of the three reported backend addresses. The CQL has no row limit; the portal returns at most 10,000 rows.
// REQUIRES: Defender for Endpoint network telemetry (DeviceNetworkEvents)
// TUNING: Keep only hits inside or shortly after the reported June to October 2026 window; exclude connections from non-browser server processes. Detect only, never block.
// LOOKBACK: 30d (Advanced Hunting retention equals the CQL window)
// CONFIGURATION: No lookup objects required.
// KNOWN GAPS: Reassigned VPS addresses can produce unrelated hits. Output is capped at 10,000 rows by the portal.
// VALIDATION LEVEL: schema-aligned
// AUTOMATED VALIDATION: static-passed; static=passed; fixtures=0/0
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemoteIP in ("162.243.64.121", "67.205.154.32", "172.86.85.51")
| project Timestamp, ReportId, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, LocalIP, RemoteIP, RemotePort
| sort by Timestamp desc
| take 10000
Q8 · Device-code authentication events in Entra sign-in logs
CONF HIGHFP MEDIUMCOST MEDIUM
Looks for: Every sign-in whose raw record carries the deviceCode authentication protocol. The device-code primitive is covered in depth by the generic device-code pack in this library; here it is the identity anchor that ties the kit to an account. Run it over 30 days, baseline legitimate use, then alert on human accounts.
FP: legitimate device-code use: CLI tools using device sign-in, conference-room and signage devices. Baseline 30 days and allowlist approved accounts and device IDs.
Validation: static-reviewedEquivalence: unsupported-without-redesignProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
- PowerQuery: SentinelOne endpoint telemetry cannot show device-code authentication events.
- KQL – Defender XDR: Defender Advanced Hunting cannot show device-code authentication events without a documented protocol column.
// HUNT: device-code authentication events in Entra sign-in logs (ECS names) // MITRE: T1528, T1078.004 | CONF: high FP: medium COST: medium // REQUIRES: Entra ID sign-in logs (interactive AND non-interactive) ingested into Falcon Next-Gen SIEM // FALSE POSITIVES: CLI tools using device sign-in, conference-room and signage devices, kiosk logins // TUNING: baseline 30 days, then exclude approved service accounts and known device IDs; alert only on // human accounts and treat a first-ever device-code event for a user as high priority // ⚠ validate in tenant: the normalized names event.action, user.email, source.ip, source.as.number, // source.as.organization.name and source.geo.country_iso_code (ECS-aligned) depend on your Entra/M365 parser // and connector version. Confirm them on one real row before trusting a zero result. // Raw Microsoft names if your parser preserves them: authenticationProtocol, userPrincipalName, ipAddress, operationName // COST: matching on @rawstring scans the repo; add your Entra sign-in parser tag as the first line to cut cost // LOOKBACK: 30d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context). @rawstring=/deviceCode/i | user.email=* | source.ip=* | table([@timestamp, user.email, source.ip, source.geo.country_iso_code, source.as.organization.name, event.action, event.outcome, user_agent.original], limit=200) | sort(@timestamp, order=desc)
1 required field · View requirements
Required telemetry
- none
Required fields
event.type: Event type
Readiness test
event.type = 'Process Creation' | limit 5 | columns event.type
// HUNT: device-code authentication events in Entra sign-in logs (ECS names) // SCHEMA PROFILE: sentinelone-endpoint-ocsf // MITRE: T1528, T1078.004 // CONF: high | FP: medium // FALSE POSITIVES: CLI tools using device sign-in, conference-room and signage devices, kiosk logins // EQUIVALENCE: unsupported-without-redesign - The card hunts Entra ID sign-in and audit records (device-code authentication, ASN spread, inbox rules and consent grants). The SentinelOne endpoint event model carries no Entra sign-in telemetry, so there is no attested field to translate to. // REQUIRES: Entra ID sign-in and audit logs ingested into a data source SentinelOne can query // TUNING: Use the CQL tab, or hunt the same events in Entra sign-in logs directly. // LOOKBACK: 14d on the CQL tab // CONFIGURATION: Use the CQL tab for this card. // KNOWN GAPS: SentinelOne endpoint telemetry cannot show device-code authentication events. // VALIDATION LEVEL: static-reviewed
1 required field · View requirements
Required telemetry
- none
Required fields
Timestamp: Event time
Readiness test
DeviceProcessEvents | where Timestamp > ago(1d) | project Timestamp | take 5
// HUNT: device-code authentication events in Entra sign-in logs (ECS names) // SCHEMA PROFILE: microsoft-defender-xdr // MITRE: T1528, T1078.004 // CONF: high | FP: medium // FALSE POSITIVES: CLI tools using device sign-in, conference-room and signage devices, kiosk logins // EQUIVALENCE: unsupported-without-redesign - The card keys on the device-code authentication protocol string in Entra sign-in logs. The documented Advanced Hunting sign-in table carries no authentication protocol column, so a Defender query would have to guess at one and could return nothing on a healthy tenant. // REQUIRES: Entra ID sign-in and audit logs // TUNING: Use the CQL tab, or filter Entra sign-in logs for the device code flow in the Entra portal. // LOOKBACK: 14d on the CQL tab // CONFIGURATION: Use the CQL tab for this card. // KNOWN GAPS: Defender Advanced Hunting cannot show device-code authentication events without a documented protocol column. // VALIDATION LEVEL: static-reviewed
Q9 · Device-code events for one user spanning two or more networks
CONF HIGHFP MEDIUMCOST MEDIUM
Looks for: Per-user rollup of device-code events by autonomous system. In a device-code phish the person completing the code is on their own network while the token is redeemed by the attacker's polling client, so a single account showing device-code events from two or more ASNs is the signature. It depends on both interactive and non-interactive sign-in logs being ingested.
FP: a user who legitimately signs in with device code from home and then from an office or VPN. Check whether the second ASN is a hosting or VPS provider and whether the first event was preceded by a lure document on that user's host (Q1, Q2, Q3).
Validation: static-reviewedEquivalence: unsupported-without-redesignProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
- PowerQuery: SentinelOne endpoint telemetry cannot show device-code events spread across two or more ASNs.
- KQL – Defender XDR: Defender Advanced Hunting cannot show device-code events spread across two or more ASNs without a documented protocol column.
// HUNT: device-code events for one user spanning two or more ASNs (victim network vs attacker polling client) // MITRE: T1528, T1550.001 | CONF: high FP: medium COST: medium // REQUIRES: Entra ID sign-in logs, interactive and non-interactive, in Falcon Next-Gen SIEM // FALSE POSITIVES: legitimate device-code users who move between home, office and VPN egress // TUNING: allowlist corporate egress ASNs and your VPN provider; keep rows where one ASN is a hosting // or VPS provider; raise DistinctAsns to 3 for a precision first pass // ⚠ validate in tenant: the normalized names event.action, user.email, source.ip, source.as.number, // source.as.organization.name and source.geo.country_iso_code (ECS-aligned) depend on your Entra/M365 parser // and connector version. Confirm them on one real row before trusting a zero result. // Raw Microsoft names if your parser preserves them: authenticationProtocol, userPrincipalName, ipAddress, operationName // LOOKBACK: 14d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context). @rawstring=/deviceCode/i | user.email=* | source.as.number=* | groupBy([user.email], function=[count(source.as.number, distinct=true, as=DistinctAsns), count(source.ip, distinct=true, as=DistinctIps), count(as=Events), collect([source.as.organization.name]), collect([source.geo.country_iso_code]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=20000) | DistinctAsns >= 2 | sort(LastSeen, order=desc)
1 required field · View requirements
Required telemetry
- none
Required fields
event.type: Event type
Readiness test
event.type = 'Process Creation' | limit 5 | columns event.type
// HUNT: device-code events for one user spanning two or more ASNs (victim network vs attacker polling client) // SCHEMA PROFILE: sentinelone-endpoint-ocsf // MITRE: T1528, T1550.001 // CONF: high | FP: medium // FALSE POSITIVES: legitimate device-code users who move between home, office and VPN egress // EQUIVALENCE: unsupported-without-redesign - The card hunts Entra ID sign-in and audit records (device-code authentication, ASN spread, inbox rules and consent grants). The SentinelOne endpoint event model carries no Entra sign-in telemetry, so there is no attested field to translate to. // REQUIRES: Entra ID sign-in and audit logs ingested into a data source SentinelOne can query // TUNING: Use the CQL tab, or hunt the same events in Entra sign-in logs directly. // LOOKBACK: 14d on the CQL tab // CONFIGURATION: Use the CQL tab for this card. // KNOWN GAPS: SentinelOne endpoint telemetry cannot show device-code events spread across two or more ASNs. // VALIDATION LEVEL: static-reviewed
1 required field · View requirements
Required telemetry
- none
Required fields
Timestamp: Event time
Readiness test
DeviceProcessEvents | where Timestamp > ago(1d) | project Timestamp | take 5
// HUNT: device-code events for one user spanning two or more ASNs (victim network vs attacker polling client) // SCHEMA PROFILE: microsoft-defender-xdr // MITRE: T1528, T1550.001 // CONF: high | FP: medium // FALSE POSITIVES: legitimate device-code users who move between home, office and VPN egress // EQUIVALENCE: unsupported-without-redesign - The card keys on the device-code authentication protocol string in Entra sign-in logs. The documented Advanced Hunting sign-in table carries no authentication protocol column, so a Defender query would have to guess at one and could return nothing on a healthy tenant. // REQUIRES: Entra ID sign-in and audit logs // TUNING: Use the CQL tab, or filter Entra sign-in logs for the device code flow in the Entra portal. // LOOKBACK: 14d on the CQL tab // CONFIGURATION: Use the CQL tab for this card. // KNOWN GAPS: Defender Advanced Hunting cannot show device-code events spread across two or more ASNs without a documented protocol column. // VALIDATION LEVEL: static-reviewed
Q10 · Post-token activity: inbox rules, OAuth consent or MFA method registration near a device-code sign-in
CONF MEDIUMFP MEDIUMCOST MEDIUM
Looks for: Per user, within the same four-hour bucket: a device-code sign-in plus at least one of a mailbox or transport rule change, an OAuth consent or delegated-permission grant, or a security-info (MFA method) registration. These are the follow-on actions ANY.RUN's guidance tells responders to review after a suspected compromise; the specific activity names are analyst extensions, not reported for this kit.
FP: an admin who registers a new MFA method or a user who builds an inbox rule during the same four hours as a legitimate device-code sign-in. Require the device-code event to come from an unexpected ASN (Q9) before escalating.
Validation: static-reviewedEquivalence: unsupported-without-redesignProfiles: microsoft-defender-xdr, sentinelone-endpoint-ocsf
Known limitations and deployment notes
- PowerQuery: SentinelOne endpoint telemetry cannot show a device-code sign-in plus inbox rule, consent or MFA registration in one bucket.
- KQL – Defender XDR: Defender Advanced Hunting cannot show a device-code sign-in plus inbox rule, consent or MFA registration in one bucket without a documented protocol column.
// HUNT: device-code sign-in plus inbox rule, OAuth consent or MFA method registration in one 4h bucket // MITRE: T1114.003, T1098.005, T1550.001 | CONF: medium FP: medium COST: medium // REQUIRES: Entra sign-in and audit logs, plus Exchange audit events, in Falcon Next-Gen SIEM // FALSE POSITIVES: legitimate device-code sign-in landing in the same 4h bucket as a normal rule change // or an MFA registration // TUNING: require the device-code event to come from an ASN not in your corporate egress set (Q9); // exclude enrolment service accounts; narrow the bucket to 1h for a precision first pass // ⚠ validate in tenant: the normalized names event.action, user.email, source.ip, source.as.number, // source.as.organization.name and source.geo.country_iso_code (ECS-aligned) depend on your Entra/M365 parser // and connector version. Confirm them on one real row before trusting a zero result. // Raw Microsoft names if your parser preserves them: authenticationProtocol, userPrincipalName, ipAddress, operationName // ⚠ validate in tenant: the user field on Entra audit rows (initiator) may differ from the sign-in user field // LOOKBACK: 14d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context). @rawstring=/(deviceCode|InboxRule|TransportRule|Consent to application|delegated permission grant|app role assignment|registered security info|Register security info)/i | case { @rawstring=/deviceCode/i | stage := "device-code-signin"; event.action=/^(New-InboxRule|Set-InboxRule|UpdateInboxRules|New-TransportRule|Set-TransportRule)$/i | stage := "inbox-or-transport-rule"; event.action=/(Consent to application|Add delegated permission grant|Add app role assignment|User registered security info|Admin registered security info|Register security info)/i | stage := "consent-or-mfa-method"; * | stage := "none"; } | stage != "none" | user.email=* | Bucket4h := @timestamp - (@timestamp % 14400000) | groupBy([user.email, Bucket4h], function=[count(stage, distinct=true, as=stages), collect([stage]), collect([source.ip]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=20000) | stages >= 2 | sort(LastSeen, order=desc)
1 required field · View requirements
Required telemetry
- none
Required fields
event.type: Event type
Readiness test
event.type = 'Process Creation' | limit 5 | columns event.type
// HUNT: device-code sign-in plus inbox rule, OAuth consent or MFA method registration in one 4h bucket // SCHEMA PROFILE: sentinelone-endpoint-ocsf // MITRE: T1114.003, T1098.005, T1550.001 // CONF: medium | FP: medium // FALSE POSITIVES: legitimate device-code sign-in landing in the same 4h bucket as a normal rule change // EQUIVALENCE: unsupported-without-redesign - The card hunts Entra ID sign-in and audit records (device-code authentication, ASN spread, inbox rules and consent grants). The SentinelOne endpoint event model carries no Entra sign-in telemetry, so there is no attested field to translate to. // REQUIRES: Entra ID sign-in and audit logs ingested into a data source SentinelOne can query // TUNING: Use the CQL tab, or hunt the same events in Entra sign-in logs directly. // LOOKBACK: 14d on the CQL tab // CONFIGURATION: Use the CQL tab for this card. // KNOWN GAPS: SentinelOne endpoint telemetry cannot show a device-code sign-in plus inbox rule, consent or MFA registration in one bucket. // VALIDATION LEVEL: static-reviewed
1 required field · View requirements
Required telemetry
- none
Required fields
Timestamp: Event time
Readiness test
DeviceProcessEvents | where Timestamp > ago(1d) | project Timestamp | take 5
// HUNT: device-code sign-in plus inbox rule, OAuth consent or MFA method registration in one 4h bucket // SCHEMA PROFILE: microsoft-defender-xdr // MITRE: T1114.003, T1098.005, T1550.001 // CONF: medium | FP: medium // FALSE POSITIVES: legitimate device-code sign-in landing in the same 4h bucket as a normal rule change // EQUIVALENCE: unsupported-without-redesign - The card keys on the device-code authentication protocol string in Entra sign-in logs. The documented Advanced Hunting sign-in table carries no authentication protocol column, so a Defender query would have to guess at one and could return nothing on a healthy tenant. // REQUIRES: Entra ID sign-in and audit logs // TUNING: Use the CQL tab, or filter Entra sign-in logs for the device code flow in the Entra portal. // LOOKBACK: 14d on the CQL tab // CONFIGURATION: Use the CQL tab for this card. // KNOWN GAPS: Defender Advanced Hunting cannot show a device-code sign-in plus inbox rule, consent or MFA registration in one bucket without a documented protocol column. // VALIDATION LEVEL: static-reviewed
09
Detection Rules by Platform
One endpoint IOA is justified; the rest is identity and mail detection. Falcon Custom IOAs act on endpoint process, file, network and registry behaviour. The token theft has no endpoint artefact, so identity detections belong in Next-Gen SIEM scheduled searches, and email detections in the mail platform.
CrowdStrike: Custom IOA
| IOA name | Rule type | Pattern | Promotes | Disposition |
|---|---|---|---|---|
| Document app starts browser with Skyw4lker URL grammar or device-code endpoint | Process Creation | Parent image matches (AcroRd32|Acrobat|FoxitPDFReader|FoxitReader|SumatraPDF|WINWORD|EXCEL|OUTLOOK|olk)\.exe; image matches (msedge|chrome|firefox|brave|iexplore)\.exe; command line matches (\/\/(it|zt)[A-Za-z0-9]{32}(us|op)|session_public\.php|private_captcha|mstoken_document_). The device-code endpoint branch stays in the hunt query (Q2) because legitimate helpdesk links hit it | Promote Q2 | DETECT only. Single-source URL grammar; a prevent action needs a second independent source |
Next-Gen SIEM scheduled searches (not IOAs)
| Search name | Query | Severity | Notes |
|---|---|---|---|
| DETECT: Device-code events from two or more networks for one user | Q9 | High | Primary identity alert. Needs interactive and non-interactive sign-in logs |
| DETECT: Device-code sign-in followed by rule, consent or MFA method change | Q10 | High | Gate with a Q9 hit to cut noise |
| HUNT: Kit-domain DNS lookups | Q5, Q6 | Medium | Single-sourced list; weekly, review with proxy logs |
Alert package: Q2 (endpoint)
SCHEDULED SEARCH: DETECT - Document App Launches Browser With Phish-Kit URL (Skyw4lker)
DESCRIPTION: A PDF reader, Office app or mail client started a browser whose command line carries the
Skyw4lker landing-token grammar, a kit asset path, or a Microsoft device-code endpoint.
SUBJECT: [HIGH] Detection: Skyw4lker phishing kit - document opened a kit or device-code URL
BODY: Host HOST-01, user jdoe. Parent process opened a browser with signal=<signal>.
kit-landing-token and kit-asset-path rows are confirmed-suspicious. A device-code-endpoint
row is hunt-grade. The device code may already have been entered: check Entra for a
device-code sign-in by this user (Q8/Q9) and revoke sessions if one exists.
TRIAGE: 1 Identify the document (CommandLine of the parent). 2 Pull the originating email and its
recipients. 3 Run Q8/Q9 for the user. 4 Check the proxy for session_public.php start/poll.
5 Check Q10 for rule, consent or MFA-method changes. 6 If any device-code event is
unexplained, run the containment runbook (section 14). 7 Isolate the host only if the
document itself is unexplained.
PIVOTS: Host: Q1 and Q3 scoped to the aid. Environment: Q5, Q6 and Q7 for the same window.
Alert package: Q9 (identity)
SCHEDULED SEARCH: DETECT - Device-Code Events For One User From Multiple Networks
DESCRIPTION: One account shows device-code authentication events from two or more ASNs, the pattern of
a victim completing a code while the attacker's client redeems the token.
SUBJECT: [HIGH] Detection: possible device-code phishing account takeover - <user>
BODY: User <user> has device-code events from <DistinctAsns> networks between <FirstSeen> and
<LastSeen>. Confirm with the user out of band (phone, not email to the account).
TRIAGE: 1 Is the second ASN a hosting or VPS provider? 2 Does the user have a CLI or room-device
reason for device sign-in? 3 Run Q10 for the user. 4 Search mail for a password-protected
attachment. 5 If unexplained: revoke sessions, reset password, review MFA methods,
inbox rules and consent grants (playbook E).
PIVOTS: User: Q8 and Q10. Environment: Q9 across all users for the same week.
SentinelOne: custom detection rules
| Rule | Source query | Run as | Notes |
|---|---|---|---|
| Document app starts browser with Skyw4lker URL grammar or device-code endpoint | Q2, PowerQuery tab | Scheduled custom detection rule | Bind entities so the alert names the host instead of "Unknown Device" |
Create the rule with POST /web/api/v2.1/cloud-detection/rules, queryType: "scheduled" and queryLang: "2.0", with the query in data.scheduledParams.query. Use 2.0 operator spellings: a rule written with the 1.0 token ContainsCIS was accepted and never fired on a tenant. The API does not warn, so lint the body before deploying.
Microsoft Defender: custom detection rules
| Rule | Source query | Run as | Notes |
|---|---|---|---|
| Document app starts browser with Skyw4lker URL grammar or device-code endpoint | Q2, KQL – Defender XDR tab | Custom detection rule, alert only, every hour | The query returns Timestamp, ReportId and DeviceId, which Microsoft recommends for Defender for Endpoint tables so alerts carry the device group scope and the process tree. Remove the Timestamp filter and the final sort and take before saving the rule: the service applies the rule's lookback itself |
Q1, Q3, Q4, Q5, Q6, Q7, Q8, Q9 and Q10 stay a hunt in this pack, not a rule. A rule can generate only 150 alerts per run. Continuous (NRT) frequency needs a single table and no comment lines, so delete the generated comment header from the query first.
10
Machine-Readable IOC Appendix
Every atomic indicator below is traceable to the saved ANY.RUN snapshot in
Skyw4lker-DeviceCode-PhishKit-Hunt-sources/. All rows are detect: the set is single-sourced, so no row is eligible for prevent or critical. Legitimate services (sites.google.com, miro.com, zoom.us, login.microsoft.com, login.microsoftonline.com) are deliberately absent.Falcon IOC Management CSVbulk import, detect only
type,value,action,severity,expiration,description,tags sha256,9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268,detect,medium,2027-04-28,Skyw4lker sample lure document (password-protected PDF; document hash not an executable),campaign:Skyw4lker ipv4,162.243.64.121,detect,medium,2027-01-28,Skyw4lker DigitalOcean backend IP (ANY.RUN; reassignable VPS),campaign:Skyw4lker ipv4,67.205.154.32,detect,medium,2027-01-28,Skyw4lker DigitalOcean backend IP (ANY.RUN; reassignable VPS),campaign:Skyw4lker ipv4,172.86.85.51,detect,medium,2027-01-28,IP shared between Skyw4lker and Gabagool (ANY.RUN; also serves a listed domain),campaign:Skyw4lker domain,0350pvas.acs-wcst.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,0ff365access.mooo.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,0utlook0ffice365admin.twilightparadox.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,1355bcra.ck29material.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,1717emxr.acs-wcst.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,5200m.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,5375jngu.prefform.us,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,6662nyde.acs-wcst.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,6695lkmo.prefform.us,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,7301eqny.acs-wcst.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,7criccasinobonus.cc,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,aachem-za.co,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,accordhealth.cc,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,acrobat-adobe-com-4464uswc.egllo.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,advancedsteelbuilding.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,alasilla.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,albertamo.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,alfabricationinc.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,apexpartsdepot.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,apinows.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,atlantictriad.ignorelist.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,atlassgroupinc.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,auth-loadingdocuments.online,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,auth.login.office365.cloud.onedrive.outlook.atlarchitacts.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,authorize.copilot.outlook.common.microsoft0365.atlarchitacts.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,awemode.outlookoffice365.microsoftcopilots.docshare.linnwest.us,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,azgymfloor.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,bandg-electrics.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,bennett002.mooo.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,bezpartien.online,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,bigbrain.chickenkiller.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,bloomfleldcapital.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,bramum.online,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,buckslu.org,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,bxcelcounselling.org,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,caine-wenier.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,calebchemicals.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,calmechc.net,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,canacedesotogroup.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,celestialtremor.org,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,celliottelliott-wellman.org,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,celvarioncorn.org,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,centipedtourspa.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,claronevents.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,cleggs.my03.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,clingard.pro,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,clubdenut.club,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,copilot.login.office365outlook.cloud.onedrive.atlarchitacts.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,copilots.outlook.cloud.microsoft.andersonelevators.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,copilots.outlook.cloud.microsoft.syrosconstructlon.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,coreansdmain.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,csr-rooflng.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,ctr-wooding.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,darap-it.co,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,detroitgardenswork.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,devtachsales.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,dguidrycardinazprofessional.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,docshare.auth.copilot.outlook.onedrive.common.earthlink-net.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,docshare.auth.copilot.outlook.onedrive.common.evergreenerg.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,docshare.auth.copilot.outlook.onedrive.common.northemheating.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,docshare.auth.copilot.outlook.onedrive.common0.evergreenerg.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,docshare.auth.copilot.outlookonedrive.common.northemheating.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,docshare.auth2026.onedrive.outlooksdocument.csr-rooflng.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,docshares.auth2026.outlookcommon.copilots.commm.csr-rooflng.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,document.akiflx.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,dpincoli.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,dutchfarrms.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,eccentric-authentication.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,ecosys.newdocument2026.pdfdocshared.tntileandmarbleinc.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,efaxdoc.auth.login.outlook.office365.tescoccontrols.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,efaxdoc.auth.outlook2026common.copilos26.bettylnc.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,efaxdoc.auth.outlook2026common.copilos26.ikextal-co-kr.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,efaxdoc.auth.outlook2026common.copilos26.kone-inc.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,efaxdoc.documents2026.cmc.docs.shared.matchlinemechanicallc.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,efaxdoc.documents2026.docs.shared.lakeviewscustom.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,eurosforgroup.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,flow505.mooo.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,flow55.chickenkiller.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,fosterswifts.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,frontdesk.click,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,gcotoncovingtoncontracting.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,ghethim.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,glafondbottamconstruction.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,globlasumi.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,gregor.justdied.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,grincool.xyz,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,haevy-llc.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,hcnyecom.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,hivezoom.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,ideahom.world,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,incommecialre.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,innvisoin.net,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,insigthinvestments.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,investomind.biz,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,jacobpwpinc.org,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,jjnysnobiogtx.org,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,kilishy.qhigh.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,kuer.online,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,lampadasdeslgn.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,lawyer.cuztools.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,lifetimeroofsystem.net,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,linking.mefound.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,linogomes-pt.cc,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,lionheartsecurityservice.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,liyuda.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,login.microsoft365.outlook.copilotsoffice365.lntactpr.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,login.office365outlooks.microsoft.cloud-outlook.naregruop.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,m365cloud.login.outlook.office365.azgymfloor.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,maqaigiapelhani.cam,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,metlarnelaw.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,metrorocl.co.uk,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,mgproparties.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,minda-mo.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,mouphyweb.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,naregruop.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,nicewayrealestate.cc,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,noxband.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,off365acess.jumpingcrab.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,off365mail.club,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,office0365login.2waky.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,outlookdrive.microsoftonline.common.oauth2.client.buycerm.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,outlookoffice365.microsoftcopilots.vigilantlnc.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,paulecosconnect.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,payapp.auth.outlook2026common.copilos26.bettylnc.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,pdfdocshared.auth.outlook2026common.copilos26.ikextal-co-kr.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,pdlhaelth.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,pdocshared.documents2026.docs.shared.ecmholdlnggroup.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,pdocshared.payments2026.outlooks.common.ecmholdlnggroup.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,photosofus.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,plusoptlx.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,priorispace.biz,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,psionicsandhorses.net,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,rapid-scale.net,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,reauth.copilot.auth.outlook.mcloud365.buycerm.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,reauth.copilot.auth.outlook.mcloud365.myhalnc.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,reauth.copilot.common.outlook.mcloud365.atlarchitacts.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,reauth.docs.copilot.auth02.outlook.mcloud365.argentventuras.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,rektham.online,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,rubinsrudman.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,rustlnsurance.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,sdocshares.auth.outlook.copilos26.general.csr-rooflng.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,sdocshares.auth.outlook2026common.copilos26.csr-rooflng.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,sdocshares.authoutlooks.common.copilots2026.hathormson.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,seatacsmarine.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,sedocs.docs.payrol2026.common.copilots2026.vatrarnsformer.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,shared.paymentsclouds.statementsapproved.jetbusinesscapltal.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,slybee.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,snk-s.org,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,solutions00fileptroduct.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,sorensenmaysflower.blog,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,statement.docdriveoauth.authorized.copilot.syrosconstructlon.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,statement.outlookoffice365.microsoftcopilots.calmechc.net,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,statements.outlook.office365microsoft.payment.run.stoneclty.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,stellarntis-fs.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,studeseliamechan.link,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,sunraycontractlng.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,sunstateaquips.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,swiftii.chickenkiller.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,tentkit.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,thepaybank.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,thewiginton.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,topcoatmetalsfinishing.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,toplinebuy.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,torvion.life,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,unitadrentals.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,unitedwirescompany.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,us-agricultures.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,vasquezmyth.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,westlakeproduces.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,whitfillsnursery.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,wsochares.authpayments.common.paid2026.bullochdirtwroks.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,wwriwashingtonenergy.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,zrs-wooding.com,detect,medium,2027-01-28,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),campaign:Skyw4lker domain,REPLACE_WITH_NEWLY_OBSERVED_KIT_DOMAIN,detect,medium,2027-01-28,add new kit hosts from ANY.RUN TI or your own proxy logs,campaign:Skyw4lker
Microsoft Defender indicators CSVSettings, Endpoints, Indicators, Import: audit only
indicatorType,indicatorValue,action,title,description,expirationTime,severity,recommendedActions,rbacGroups,category,mitretechniques,GenerateAlert FileSha256,9aa0b87974b9b4cd42603833b7ad44257578467d279b315a071108a5ed02c268,Audit,Skyw4lker sample lure document,Skyw4lker sample lure document (password-protected PDF; document hash not an executable),2027-04-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True IpAddress,162.243.64.121,Audit,Skyw4lker DigitalOcean backend IP,Skyw4lker DigitalOcean backend IP (ANY.RUN; reassignable VPS),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True IpAddress,67.205.154.32,Audit,Skyw4lker DigitalOcean backend IP,Skyw4lker DigitalOcean backend IP (ANY.RUN; reassignable VPS),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True IpAddress,172.86.85.51,Audit,IP shared between Skyw4lker and Gabagool,IP shared between Skyw4lker and Gabagool (ANY.RUN; also serves a listed domain),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,0350pvas.acs-wcst.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,0ff365access.mooo.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,0utlook0ffice365admin.twilightparadox.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,1355bcra.ck29material.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,1717emxr.acs-wcst.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,5200m.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,5375jngu.prefform.us,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,6662nyde.acs-wcst.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,6695lkmo.prefform.us,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,7301eqny.acs-wcst.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,7criccasinobonus.cc,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,aachem-za.co,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,accordhealth.cc,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,acrobat-adobe-com-4464uswc.egllo.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,advancedsteelbuilding.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,alasilla.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,albertamo.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,alfabricationinc.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,apexpartsdepot.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,apinows.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,atlantictriad.ignorelist.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,atlassgroupinc.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,auth-loadingdocuments.online,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,auth.login.office365.cloud.onedrive.outlook.atlarchitacts.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,authorize.copilot.outlook.common.microsoft0365.atlarchitacts.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,awemode.outlookoffice365.microsoftcopilots.docshare.linnwest.us,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,azgymfloor.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,bandg-electrics.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,bennett002.mooo.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,bezpartien.online,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,bigbrain.chickenkiller.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,bloomfleldcapital.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,bramum.online,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,buckslu.org,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,bxcelcounselling.org,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,caine-wenier.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,calebchemicals.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,calmechc.net,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,canacedesotogroup.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,celestialtremor.org,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,celliottelliott-wellman.org,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,celvarioncorn.org,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,centipedtourspa.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,claronevents.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,cleggs.my03.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,clingard.pro,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,clubdenut.club,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,copilot.login.office365outlook.cloud.onedrive.atlarchitacts.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,copilots.outlook.cloud.microsoft.andersonelevators.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,copilots.outlook.cloud.microsoft.syrosconstructlon.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,coreansdmain.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,csr-rooflng.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,ctr-wooding.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,darap-it.co,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,detroitgardenswork.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,devtachsales.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,dguidrycardinazprofessional.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,docshare.auth.copilot.outlook.onedrive.common.earthlink-net.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,docshare.auth.copilot.outlook.onedrive.common.evergreenerg.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,docshare.auth.copilot.outlook.onedrive.common.northemheating.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,docshare.auth.copilot.outlook.onedrive.common0.evergreenerg.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,docshare.auth.copilot.outlookonedrive.common.northemheating.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,docshare.auth2026.onedrive.outlooksdocument.csr-rooflng.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,docshares.auth2026.outlookcommon.copilots.commm.csr-rooflng.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,document.akiflx.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,dpincoli.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,dutchfarrms.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,eccentric-authentication.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,ecosys.newdocument2026.pdfdocshared.tntileandmarbleinc.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,efaxdoc.auth.login.outlook.office365.tescoccontrols.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,efaxdoc.auth.outlook2026common.copilos26.bettylnc.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,efaxdoc.auth.outlook2026common.copilos26.ikextal-co-kr.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,efaxdoc.auth.outlook2026common.copilos26.kone-inc.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,efaxdoc.documents2026.cmc.docs.shared.matchlinemechanicallc.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,efaxdoc.documents2026.docs.shared.lakeviewscustom.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,eurosforgroup.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,flow505.mooo.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,flow55.chickenkiller.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,fosterswifts.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,frontdesk.click,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,gcotoncovingtoncontracting.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,ghethim.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,glafondbottamconstruction.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,globlasumi.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,gregor.justdied.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,grincool.xyz,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,haevy-llc.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,hcnyecom.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,hivezoom.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,ideahom.world,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,incommecialre.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,innvisoin.net,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,insigthinvestments.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,investomind.biz,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,jacobpwpinc.org,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,jjnysnobiogtx.org,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,kilishy.qhigh.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,kuer.online,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,lampadasdeslgn.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,lawyer.cuztools.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,lifetimeroofsystem.net,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,linking.mefound.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,linogomes-pt.cc,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,lionheartsecurityservice.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,liyuda.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,login.microsoft365.outlook.copilotsoffice365.lntactpr.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,login.office365outlooks.microsoft.cloud-outlook.naregruop.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,m365cloud.login.outlook.office365.azgymfloor.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,maqaigiapelhani.cam,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,metlarnelaw.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,metrorocl.co.uk,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,mgproparties.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,minda-mo.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,mouphyweb.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,naregruop.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,nicewayrealestate.cc,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,noxband.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,off365acess.jumpingcrab.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,off365mail.club,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,office0365login.2waky.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,outlookdrive.microsoftonline.common.oauth2.client.buycerm.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,outlookoffice365.microsoftcopilots.vigilantlnc.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,paulecosconnect.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,payapp.auth.outlook2026common.copilos26.bettylnc.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,pdfdocshared.auth.outlook2026common.copilos26.ikextal-co-kr.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,pdlhaelth.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,pdocshared.documents2026.docs.shared.ecmholdlnggroup.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,pdocshared.payments2026.outlooks.common.ecmholdlnggroup.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,photosofus.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,plusoptlx.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,priorispace.biz,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,psionicsandhorses.net,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,rapid-scale.net,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,reauth.copilot.auth.outlook.mcloud365.buycerm.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,reauth.copilot.auth.outlook.mcloud365.myhalnc.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,reauth.copilot.common.outlook.mcloud365.atlarchitacts.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,reauth.docs.copilot.auth02.outlook.mcloud365.argentventuras.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,rektham.online,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,rubinsrudman.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,rustlnsurance.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,sdocshares.auth.outlook.copilos26.general.csr-rooflng.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,sdocshares.auth.outlook2026common.copilos26.csr-rooflng.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,sdocshares.authoutlooks.common.copilots2026.hathormson.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,seatacsmarine.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,sedocs.docs.payrol2026.common.copilots2026.vatrarnsformer.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,shared.paymentsclouds.statementsapproved.jetbusinesscapltal.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,slybee.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,snk-s.org,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,solutions00fileptroduct.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,sorensenmaysflower.blog,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,statement.docdriveoauth.authorized.copilot.syrosconstructlon.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,statement.outlookoffice365.microsoftcopilots.calmechc.net,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,statements.outlook.office365microsoft.payment.run.stoneclty.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,stellarntis-fs.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,studeseliamechan.link,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,sunraycontractlng.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,sunstateaquips.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,swiftii.chickenkiller.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,tentkit.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,thepaybank.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,thewiginton.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,topcoatmetalsfinishing.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,toplinebuy.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,torvion.life,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,unitadrentals.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,unitedwirescompany.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,us-agricultures.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,vasquezmyth.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,westlakeproduces.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,whitfillsnursery.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,wsochares.authpayments.common.paid2026.bullochdirtwroks.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,wwriwashingtonenergy.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True DomainName,zrs-wooding.com,Audit,Skyw4lker kit-hosting domain,Skyw4lker kit-hosting domain (ANY.RUN single source; may be a compromised site),2027-01-28T00:00:00.0Z,Medium,Investigate the device and pivot into the pack's queries,,,,True
Column names and allowed values are from Microsoft's documented parameter table. Left out because the value is a placeholder, defanged or not valid for its type (fix it in the pack's CSV first): placeholder 1. Check each expirationTime before importing: an indicator whose date has passed is already expired. Download the sample CSV from the Import page to confirm the column order before a bulk import. Each file takes at most 500 indicators. Learn describes the import per entity type, so if a mixed file is rejected, split it by indicatorType. An imported indicator does nothing unless the matching Advanced features are on (for example Custom network indicators and Allow or block file).
SentinelOne IOC importnot included
This pack does not ship a SentinelOne import block: the import format could not be verified against SentinelOne's own documentation. Export a sample from your console and the block can be added with confidence.
Behavioural signaturesproxy, DNS, mail
# Skyw4lker behavioural signatures (ANY.RUN; single source). PCRE. Hunt or alert, never block on one hit.
# --- URL path / grammar (proxy, secure web gateway, DNS-over-URL logs)
//(it[A-Za-z0-9]{32}us|zt[A-Za-z0-9]{32}op)(\?{1,2})?$
/assets/php/endpoints/session_public\.php\?action=(start|poll)
/assets/php/endpoints/(confirm_visit|private_captcha_challenge|client_geo|accounts)\.php
/assets/js/(client_geo|endpoint|url_helper)\.js
/assets/private_captcha/public/widget\.(js|css)
/assets/php/attach/js/mstoken_document_(adobe|onedrive|excel)_[A-Za-z0-9]{50}\.js
# --- lure attachment filenames
-protected\.(pdf|docx?|xlsx?)$
^DOC [A-Za-z0-9]{10}\.pdf$
# --- hostname grammar (look-alike Microsoft-themed chain)
^(docshare|sdocshares|pdocshared|pdfdocshared|efaxdoc|reauth|statement|copilot|login|auth)[a-z0-9.-]*(outlook|onedrive|copilot|office365)
# --- genuine Microsoft endpoints the victim is steered to (CONTEXT, never block by domain)
login.microsoft.com/device
login.microsoftonline.com/common/oauth2/deviceauth
Conditional Access audit and blockidentity
# Conditional Access audit and block checklist (Microsoft Learn: block authentication flows)
1. Sign-in logs, filter Authentication Protocol = Device code flow (interactive AND non-interactive), 30 days.
2. Classify every hit: approved service account | kiosk or room device | developer CLI | unknown.
3. Create the policy in Report-only: All users, All resources, Conditions > Authentication flows = Device code flow, Grant = Block.
4. Exclude emergency-access (break-glass) accounts; audit the exclusion list regularly.
5. Review Report-only impact for 1 to 2 weeks, then switch the policy to On.
6. Keep any exception scoped to specific accounts or devices, never tenant-wide.
# Graph policy body (transferMethods value is deviceCodeFlow)
{ "displayName": "CA-Block-DeviceCodeFlow",
"state": "enabledForReportingButNotEnforced",
"conditions": { "users": {"includeUsers": ["All"], "excludeUsers": ["BREAK-GLASS-USER-OBJECT-ID"]},
"applications": {"includeApplications": ["All"]},
"authenticationFlows": {"transferMethods": "deviceCodeFlow"} },
"grantControls": { "operator": "OR", "builtInControls": ["block"] } }
Posture by source count: sample hash, 3 IPs and 173 domains are one-source (ANY.RUN) so every row is detect. No prevent or critical row exists in the CSV, section 4, section 9 or section 13.
11
Detection Validation Gates
Gate 1: telemetry is present
An empty result means either "no activity" or "no data". Prove the data first.
1. Endpoint process (CrowdStrike: ProcessRollup2. SentinelOne: Process Creation. Defender: DeviceProcessEvents): run Q1 without the CommandLine filter and head(10). 2. Endpoint DNS (CrowdStrike: DnsRequest. SentinelOne: DNS Resolved. Defender: DeviceEvents DNS action type): run Q4 without the DomainName filter and head(10). 3. Entra sign-in logs, interactive AND non-interactive: run Q8 and confirm at least one row. 4. Entra audit and Exchange audit: run Q10 with the case block removed and head(10). 5. Web proxy: confirm full URL paths (not only hostnames) are logged. Without paths, N1 cannot work. 6. If 3 or 4 return nothing, STOP: fix ingestion before reporting "no findings".
Gate 2: field shape matches your parser
Q8 to Q10 use ECS-aligned names (user.email, source.ip, source.as.number, event.action). Run each once on a 1-hour window with head(10). If a field is empty, inspect one raw row and map it (raw Microsoft names: userPrincipalName, ipAddress, authenticationProtocol, operationName). Add your Entra parser tag as the first line to cut cost, then re-run.
Gate 3: positive control (safe, your own tenant)
1. Create a harmless text file named "DOC abcdefghij.pdf" and open it with your PDF reader on a test host. Q1 should return it. Delete the file afterwards. Do not build or host a phishing lure. 2. With change approval, run a legitimate device sign-in with a TEST account (for example the Azure CLI device sign-in). Confirm it appears in Q8 within your ingestion latency, and record that latency. 3. Revoke the test account's sessions afterwards. This validates detection only.
Gate 4: baseline before alerting
Run Q8 over 30 days and classify every result: approved service account | room or kiosk device | developer CLI | unknown. Allowlist the first three, investigate the fourth. An unbaselined Q8 is noisy; a baselined Q9 is close to zero false positives for human accounts.
Gate 5: promotion
Q2 -> endpoint IOA in Detect after 14 days of clean baseline. Q9 and Q10 -> Next-Gen SIEM scheduled searches, severity High, after Gate 4. Q5, Q6, Q7 -> weekly hunt; never promote to a block, the indicators are single-sourced.
12
Hardening: Tiered & Deployable
The headline control is a Conditional Access policy that blocks the device code flow. It removes the primitive Skyw4lker needs, regardless of which kit, domain or lure is used. Everything else reduces exposure or speeds detection.
Immediate: deploy this week
1 Block the device code flow with Conditional Access CRITICAL
MITRE M1042 (Disable or Remove Feature or Program) for T1528. Authority: Microsoft Learn, Conditional Access block authentication flows and authentication flows (snapshots 05, 06): Microsoft recommends blocking device code flow wherever possible. Policy: All users, All resources, Conditions > Authentication flows > Device code flow, Grant > Block, break-glass excluded, Report-only first. No formal CIS benchmark control was verified in this run; vendor guidance is the authority.
- Why this is the headline control: the victim completes MFA on Microsoft's own page, so MFA strength does not stop it. Phishing-resistant MFA alone does not stop it either (analyst inference): the user's own successful sign-in is what grants the attacker's session. Blocking the flow removes the primitive.
- Verify:
Get-MgIdentityConditionalAccessPolicy | Where-Object DisplayName -like '*DeviceCode*'shows stateenabled; Q8 then shows blocked results, not successes.
2 Audit existing device-code use before enforcing HIGH
MITRE M1047 (Audit). Filter sign-in logs on the authentication protocol for 30 days, classify each user, and scope any exception to named accounts or devices (Microsoft Learn, snapshots 05, 06). Verify: Q8 over 30 days with every row classified.
3 Treat external password-protected attachments as suspect HIGH
MITRE M1054 (Software Configuration) and M1031 (Network Intrusion Prevention) for T1566.001. Authority: Microsoft Learn mail flow rule condition "Any attachment is password protected", which covers Office files, archives and PDF (snapshot 08). Start in Audit mode, then quarantine. Expect legitimate business use; allowlist known partners. Verify: message trace shows the rule matching; playbook C.
4 Ingest the telemetry the detections need HIGH
MITRE M1047 (Audit). Ingest Entra interactive and non-interactive sign-in logs, the Entra audit log and the Exchange audit log into Next-Gen SIEM, and confirm mailbox auditing is on. Verify: Gate 1 steps 3 and 4.
Near term: 1 to 4 weeks, pilot on a ring first
5 Require a managed or compliant device for Microsoft 365 access HIGH
MITRE M1036 (Account Use Policies) and M1032 (Multi-factor Authentication). Microsoft notes device code flow can be used to reach corporate resources from unmanaged devices (snapshot 06). A Conditional Access grant of compliant or hybrid-joined device limits what a token redeemed on attacker infrastructure can reach (analyst inference; pilot in Report-only). Verify: Report-only results for the policy.
6 Restrict user consent to applications MEDIUM
MITRE M1021 (Restrict Web-Based Content) and M1018 (User Account Management); both appear in MITRE's T1528 mitigations (snapshot 13). Authority: Microsoft Learn, configure user consent (snapshot 11): allow user consent only for verified publishers or require admin consent. Verify: Get-MgPolicyAuthorizationPolicy shows the assigned grant policies.
7 Protect security-info registration MEDIUM
MITRE M1032 and M1018 for T1098.005. Authority: Microsoft Learn, Conditional Access user action "Register security information" (snapshot 12). Require a trusted location or compliant device so a stolen token cannot add an attacker MFA method. Verify: Report-only results; Q10 consent-or-mfa-method rows fall to expected volume.
8 Resolver and gateway controls on look-alike hostnames MEDIUM
MITRE M1021 (Restrict Web-Based Content) for T1566.002 and T1583.001. Run the Microsoft-themed hostname grammar (section 10 signatures) in monitor mode on the resolver or gateway first. Best-practice, no formal benchmark. Do not block by the 173-domain list alone; it is single-sourced and includes apparently compromised business sites. Verify: Q4 hit counts before and after.
Strategic: 1 to 3 months
9 Continuous access evaluation and session revocation readiness STRATEGIC
MITRE M1018. Microsoft Learn (snapshot 07) describes continuous access evaluation as letting admins revoke tokens for CAE-capable apps rather than waiting for token expiry; the default access token lifetime is about one hour. Confirm CAE coverage and rehearse revocation. Verify: a test account revocation takes effect inside your target window.
10 User training on the exact request STRATEGIC
MITRE M1017 (User Training), listed under T1528 (snapshot 13). Teach one rule: never enter a code on a Microsoft page that arrived from a document or an unsolicited link. Best-practice, no formal benchmark.
11 Automate response on a device-code anomaly STRATEGIC
MITRE M1047. Wire the Q9 scheduled search to a workflow that notifies the user out of band and, after a human confirm, revokes sessions (playbook E). Verify: a Gate 3 test account walks the workflow end to end.
13
Deployable Playbooks
Every step carries Prerequisites, Reboot required and Rollback. Replace example values (jdoe@example.com, the break-glass object ID) before running.
PLAYBOOK A: Audit device-code use before blocking (read-only)
Prerequisites: Reports Reader or Security Reader on the tenant
Reboot required: No
Steps:
1. Run the Entra sign-in log filter in section 7, N2, for 30 days, interactive and non-interactive.
2. Export and classify each user: approved | room or kiosk | developer CLI | unknown.
3. Record the approved list; it becomes the Conditional Access exclusion or exception scope.
Verify: Q8 returns the same population over the same window.
Rollback: none required, this step only reads logs.
PLAYBOOK B: Block the device code flow (Report-only, then enforce)
Prerequisites: Conditional Access Administrator; Microsoft.Graph.Identity.SignIns module;
the object ID of at least one emergency-access account
Reboot required: No
Config (PowerShell, Microsoft Graph; transferMethods value per Graph docs):
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess","Policy.Read.All"
$body = @{
displayName = "CA-Block-DeviceCodeFlow"
state = "enabledForReportingButNotEnforced"
conditions = @{
users = @{ includeUsers = @("All"); excludeUsers = @("<BREAK-GLASS-USER-OBJECT-ID>") }
applications = @{ includeApplications = @("All") }
authenticationFlows = @{ transferMethods = "deviceCodeFlow" }
}
grantControls = @{ operator = "OR"; builtInControls = @("block") }
}
$p = New-MgIdentityConditionalAccessPolicy -BodyParameter $body
# After 1 to 2 weeks of Report-only review, enforce:
Update-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $p.Id -State enabled
Verify: Get-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $p.Id | Select-Object DisplayName,State
Rollback: Update-MgIdentityConditionalAccessPolicy -ConditionalAccessPolicyId $p.Id -State disabled
(or Remove-MgIdentityConditionalAccessPolicy to delete). Re-run Playbook A to explain any breakage.
PLAYBOOK C: Audit, then quarantine, external password-protected attachments
Prerequisites: Exchange Online Transport Rules role; a list of partners that legitimately send protected files
Reboot required: No
Config (Exchange Online PowerShell):
Connect-ExchangeOnline
New-TransportRule -Name "External password-protected attachments (audit)" `
-FromScope NotInOrganization -AttachmentIsPasswordProtected $true `
-Mode Audit -SetAuditSeverity High `
-Comments "Password-protected files bypass scanning. Audit first, then quarantine."
# After reviewing the message trace for false positives, enforce:
Set-TransportRule -Identity "External password-protected attachments (audit)" -Mode Enforce -Quarantine $true
Verify: Get-TransportRule "External password-protected attachments (audit)" | Format-List Name,Mode,State
Rollback: Disable-TransportRule -Identity "External password-protected attachments (audit)"
(or Remove-TransportRule). Released messages are delivered normally.
PLAYBOOK D: Import the indicators as DETECT in Falcon (never prevent)
Prerequisites: Falcon IOC Management write access; the section 10 CSV
Reboot required: No
Steps:
1. Falcon console > IOC Management > Import, upload the section 10 CSV (type,value,action,severity,expiration,description,tags).
2. Confirm every row imported with action detect. Replace REPLACE_WITH_NEWLY_OBSERVED_KIT_DOMAIN or delete that row.
3. Schedule Q5, Q6 and Q7 weekly as hunts, and review hits with proxy logs before escalating.
Verify: IOC Management shows 177 rows tagged campaign:Skyw4lker, all detect (plus the placeholder if kept).
Rollback: IOC Management > filter tag campaign:Skyw4lker > select all > delete. Indicators also expire on 2027-01-28.
PLAYBOOK E: Contain a suspected device-code account takeover
Prerequisites: User Administrator and Exchange Administrator; Microsoft.Graph and ExchangeOnlineManagement modules;
the user was contacted out of band
Reboot required: No
Config:
Connect-MgGraph -Scopes "User.ReadWrite.All","UserAuthenticationMethod.Read.All","Directory.Read.All"
$upn = "jdoe@example.com"
Revoke-MgUserSignInSession -UserId $upn # invalidates refresh tokens
Update-MgUser -UserId $upn -AccountEnabled:$false # disable during triage
Get-MgUserAuthenticationMethod -UserId $upn # remove any method added in the window
Get-MgUserOauth2PermissionGrant -UserId $upn # review delegated consent
Connect-ExchangeOnline
Get-InboxRule -Mailbox $upn | Format-List Name,Enabled,ForwardTo,RedirectTo,DeleteMessage,MoveToFolder
Verify: Q8 shows no further events for the user after revocation; sign-in logs show interactive re-authentication only.
Rollback: Update-MgUser -UserId $upn -AccountEnabled:$true once the account is clean.
Revocation itself needs no rollback: it only forces re-authentication.
14
Containment Runbook
Revoke tokens and reset the password; one without the other is not containment. A stolen refresh token keeps working after a password change until it is revoked (Microsoft Learn, snapshot 07), and the shared kit module can log credentials.
| Phase | Actions | Owner | Evidence |
|---|---|---|---|
| Isolate (0 to 30 min) | Contact the user out of band (phone or in person, not email to the account). Revoke sessions: Revoke-MgUserSignInSession (playbook E). Disable the account while triaging. Reset the password and require change at next sign-in, because the shared kit module can log credentials. Network-contain the host that opened the lure document only if the document is unexplained. | Identity on-call, SOC | Revocation timestamp; sign-in logs show re-authentication only |
| Isolate: by platform | CrowdStrike: network-contain the host. SentinelOne: network quarantine (Disconnect from Network; confirm the label in your console version). Microsoft Defender: Isolate device (full network isolation). | Identity on-call, SOC | Revocation timestamp; sign-in logs show re-authentication only |
| Scope (30 min to 2 h) | Message-trace the lure to every recipient. Run Q9 and Q10 tenant-wide for the window. Search the proxy for session_public.php start/poll from any host (N1). Identify every user who opened a lure-pattern document (Q1, Q3). | SOC, mail admin | Recipient list; Q9/Q10 output; proxy hits |
| Eradicate (2 to 4 h) | Remove attacker-added MFA methods and mailbox rules or forwarding. Review and revoke OAuth consent grants and app registrations created in the window. Import the section 10 CSV as detect. Add confirmed new kit hosts. | Identity admin, Exchange admin | Methods, rules and grants listed before and after |
| Recover (24 to 72 h) | Re-enable the account after verification. Enforce the device-code block policy (playbook B) and the password-protected attachment rule (playbook C). Check that CAE and sign-in logging are on. Notify users in the cohort. | Identity, security engineering | Policy state; ingestion confirmed (Gate 1) |
| Review (1 to 2 weeks) | Hunt the same tenant for other lure recipients with Q5 to Q7 and the proxy signatures. Feed new indicators back into the pack. Record the incident timeline. | Threat hunting | Closed ticket; updated pack |
15
Detection Coverage Map
| Technique | Behavior | CQL | IOA | CrowdStrike coverage | SentinelOne | Defender XDR |
|---|---|---|---|---|---|---|
| T1566.001 Lure email with protected attachment | Email delivery is outside endpoint telemetry. Endpoint sees only the document open | Q1, Q3 | None | Partial | Partial: Q3 approximate | Partial: Q3 unavailable |
| Document written to disk | No query written: the documented file-written events cover executables and archives, not PDF/DOCX/XLSX | None | None | GAP | GAP | GAP |
| T1204.001 Document opens browser with a URL | Only when a process is started with the URL as an argument | Q2 | Promote Q2 | Partial | Partial: same limit as CrowdStrike | Partial: same limit as CrowdStrike |
| In-browser navigation to the Microsoft device page | Endpoint telemetry has no URL path for navigation inside a running browser. Real gap | None | None | GAP | GAP | GAP |
| T1583.001 Kit domain resolution | Reported list plus hostname grammar | Q3, Q4, Q5, Q6 | None | Good | Partial: Q3 approximate | Partial: Q3 unavailable |
| T1583.003 Kit backend IP connections | Three reported IPs; reassignable VPS space | Q7 | None | Partial | Partial: same limit as CrowdStrike | Partial: same limit as CrowdStrike |
| Kit backend paths (session_public.php start/poll, client_geo.js, CAPTCHA widget, mstoken_document scripts) | Proxy or web gateway telemetry only. Falcon endpoint cannot see them. N1 covers it if URL paths are logged | None | None | GAP | GAP | GAP |
| T1497 / T1027 CAPTCHA and obfuscated JavaScript | No endpoint artefact | None | None | GAP | GAP | GAP |
| T1528 Token theft at Microsoft's identity plane | Entra sign-in logs only. No endpoint artefact by design | Q8, Q9 | None | Good | GAP | GAP |
| Sample document hash | A document hash is not an endpoint-queryable file hash. Use mail security and sandbox (N3) | None | None | GAP | GAP | GAP |
| T1114.003 / T1098.005 / T1550.001 follow-on activity | Analyst extension; depends on Entra audit and Exchange audit ingestion | Q10 | None | Partial | GAP | GAP |
| Unmanaged and personal devices | No sensor: the victim may open the lure on a phone or a home PC | None | None | GAP | GAP | GAP |
Overlap with the existing device-code pack, stated plainly: Q8 and the multi-ASN idea in Q9 cover the generic identity-side device-code primitive, which the library's existing device-code pack already treats in depth. They are included here because they are the only place the token theft is visible. The kit-specific coverage is Q1 to Q7: the lure filenames, the landing-token grammar, the look-alike hostname chain, the 173-domain and backend-IP infrastructure, and the document-to-browser hop.
Validation gates: see section 11. Run Gates 1 to 4 before trusting any empty result.
16
Hunt Summary Ticket
TITLE: Hunt - Skyw4lker device-code phishing kit (Microsoft 365 account takeover)
VERSION: v0.1 - 2026-10-28
SEVERITY: High (MFA-bypassing token theft; no endpoint artefact; attributed to no actor)
SCOPE: Entra ID / Microsoft 365 identity plane; managed endpoints (document open, browser launch,
DNS, connections); web proxy; email gateway
HYPOTHESIS: Password-protected PDF/DOCX/XLSX lure -> CAPTCHA page (optionally via a Miro, Google Sites
or Zoom hop) -> kit page calls session_public.php start, shows a real Microsoft device
code -> victim authenticates at Microsoft -> backend polls and receives tokens.
QUERIES RUN: CQL Q1 lure document open | Q2 document app launches browser with kit URL or device-code
endpoint | Q3 lure doc plus look-alike host DNS | Q4 look-alike hostname grammar |
Q5/Q6 kit-domain DNS (173 domains, 2 parts) | Q7 backend IP connections |
Q8 device-code events | Q9 device-code events across 2+ ASNs | Q10 post-token rule/consent/MFA
Native: N1 proxy URL grammar | N2 Entra protocol filter | N3 attachment name and hash | N4 checklist
DO FIRST: Baseline Q8 over 30 days, then alert on Q9. Put the device-code block policy in Report-only.
If Q8 returns nothing, verify Entra ingestion (interactive AND non-interactive) before believing it.
FINDINGS: <pending analyst execution>
GAPS: Email delivery, in-browser navigation, kit backend paths and token theft are outside endpoint
telemetry (proxy, mail and identity logs only). Document hashes are not endpoint-queryable.
Unmanaged devices have no sensor. Every indicator is single-sourced to ANY.RUN; the
Hacker News piece is a contributed partner article, not independent corroboration.
ACTIONS: 1. Verify telemetry (Gate 1) 2. Playbook A then B: audit and block device code flow
3. Playbook C: audit external password-protected attachments 4. Playbook D: import CSV as DETECT
5. Promote Q2 as an IOA in Detect, Q9/Q10 as scheduled searches 6. Revoke-and-reset on any hit
OWNER: HuntPack
17
Changelog
v0.12026-10-28Initial pack. Fourteen source snapshots (ANY.RUN, The Hacker News, a secondary Gabagool article, a generic device-code article, Microsoft Learn, MITRE and RFC 8628) plus a token index; the TRAC Labs original was blocked (HTTP 403) and is not cited as evidence. 10 CQL queries (7 endpoint, 3 identity), 4 native hunts, 16 ATT&CK rows (3 labelled analyst extension), 11 tiered hardening controls, 5 playbooks with rollback, a phased containment runbook. All 177 atomic indicators are detect-only because they are single-sourced. Figures printed with their source discrepancies (46% versus 47% US share; healthcare is a single-source sector claim). SentinelOne PowerQuery and Microsoft Defender KQL tabs added to Q1-Q10: SIEM Query Rosetta release 0.1.0 (public-beta; static-reviewed translations).
18
References
| Tier | Source | Used for | Access date |
|---|---|---|---|
| T1 vendor | ANY.RUN: SkyW4lker Exposed, a Growing Microsoft 365 Phishing Threat to American Enterprises | All kit mechanics, indicators, scale, Gabagool lineage, detection guidance | 2026-10-28 |
| T3 contributed | The Hacker News: Skyw4lker Device Code Phishing Campaign Exposed | Sector focus; sites.google.com lure hop. Contributed partner piece | 2026-10-28 |
| T3 secondary | Daily CyberSecurity: Gabagool kit exploiting Cloudflare R2 (TRAC Labs coverage) | Background only; not used for lineage | 2026-10-28 |
| T3 trade press | Cyber Security News: OAuth device code abuse | Generic primitive background | 2026-10-28 |
| T1 vendor docs | Microsoft Learn: Conditional Access, block authentication flows | Headline hardening control | 2026-10-28 |
| T1 vendor docs | Microsoft Learn: Conditional Access, authentication flows | Risk statement, protocol tracking, log filter | 2026-10-28 |
| T1 vendor docs | Microsoft Graph: conditionalAccessAuthenticationFlows | Policy body value deviceCodeFlow | 2026-10-28 |
| T1 vendor docs | Microsoft Learn: revoke user access in an emergency | Containment | 2026-10-28 |
| T1 vendor docs | Microsoft Learn: mail flow rule conditions; New-TransportRule | Password-protected attachment rule | 2026-10-28 |
| T1 vendor docs | Microsoft Learn: configure user consent; CA target resources and user actions | Consent and security-info registration controls | 2026-10-28 |
| T1 reference | MITRE ATT&CK T1528; T1566.001; T1566.002; T1550.001; T1114.003; T1098.005 | Technique mapping and mitigation M-codes | 2026-10-28 |
| T1 reference | IETF RFC 8628: OAuth 2.0 Device Authorization Grant | The legitimate protocol being abused | 2026-10-28 |
| Not retrieved | TRAC Labs: Gabagool analysis | Automated fetch returned HTTP 403; listed for completeness, not used as evidence | 2026-10-28 |
Generated 2026-10-28 · HuntPack v0.1 · Defensive content only: hunt, detection and hardening guidance. Source snapshots retained in Skyw4lker-DeviceCode-PhishKit-Hunt-sources/ for indicator provenance verification.