Detections

Analysis of CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

CaptiveCrunch Doppelganger Domain DNS Query

sigma · generated; parse required before publication

title: CaptiveCrunch Doppelganger Domain DNS Query
description: Detects DNS queries to look-alike Microsoft domains used in CaptiveCrunch
  AitM phishing.
logsource:
  product: windows
  service: dns
detection:
  selection:
    query.name: m365-owa.com
  condition: selection
level: medium
tags: []
references: []

apt_midnight_blizzard_captivecrunch

yara · compile required before publication

rule apt_midnight_blizzard_captivecrunch {
  strings:
    $s1 = "captive_portal_intercept" ascii wide nocase
    $s2 = "entra_device_code_auth" ascii wide nocase
  condition:
    any of them
}