peak-to-sigma

// ── T1557.001: Adversary-in-the-Middle — AiTM Process Injection ──────────────
// Hunt: AiTM Proxy Detection — Infostealer Delivery (Scoped)
// Author: Andre Seguin | Date: 2026-04-08 | Confidence: HIGH
// ATT&CK: T1557.001 — Credential Access

DeviceProcessEvents
| where Timestamp > ago(7d)
| where
    FileName has "suspicious_proxy.exe"
    or InitiatingProcessFileName =~ "explorer.exe" and FileName has "suspicious_proxy.exe"
| extend Technique = "T1557.001", Tactic = "CredentialAccess", Confidence = "High"
| project
    Timestamp, DeviceName, AccountName,
    FileName, ProcessCommandLine, SHA256,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    Technique, Tactic, Confidence
| order by Timestamp desc

// ── T1539: Steal Web Session Cookie — Impossible Travel ───────────────────────
// Hunt: AiTM Proxy Detection — Infostealer Delivery (Scoped)
// Author: Andre Seguin | Date: 2026-04-08 | Confidence: HIGH
// ATT&CK: T1539 — Credential Access
// Note: 203.0.113.47 is an RFC 5737 documentation IP used in this example.

SigninLogs
| where TimeGenerated > ago(7d)
| where
    IPAddress == "203.0.113.47"
    or NetworkLocationDetails has "aitm-proxy.example.com"
| extend Technique = "T1539", Tactic = "CredentialAccess", Confidence = "High"
| project
    TimeGenerated, UserPrincipalName, AppDisplayName,
    IPAddress, Location, DeviceDetail,
    ConditionalAccessStatus, RiskLevelDuringSignIn,
    Technique, Tactic, Confidence
| order by TimeGenerated desc

| comment "T1557.001: Adversary-in-the-Middle — AiTM Process Injection"
| comment "Hunt: AiTM Proxy Detection — Infostealer Delivery (Scoped)"
| comment "Author: Andre Seguin | Date: 2026-04-08 | ATT&CK: T1557.001"

index=* sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    (process_name="*suspicious_proxy.exe*"
     OR (parent_process="*\\explorer.exe" AND process_name="*suspicious_proxy.exe*"))
| eval technique="T1557.001", tactic="Credential Access", confidence="high"
| table _time host user process_name parent_process CommandLine sha256 technique tactic
| sort -_time

| append [
| comment "T1539: Steal Web Session Cookie — Impossible Travel"
| comment "Note: 203.0.113.47 is RFC 5737 documentation address (example only)"
  index=* sourcetype=azure:aad:signin
    (src_ip="203.0.113.47" OR dest="aitm-proxy.example.com")
  | eval technique="T1539", tactic="Credential Access", confidence="high"
  | table _time user app src_ip dest authentication_method risk_level technique tactic
  | sort -_time
]

-- ── T1557.001: Adversary-in-the-Middle — AiTM Process Injection ──────────────
-- Hunt: AiTM Proxy Detection — Infostealer Delivery
-- Author: Andre Seguin | Date: 2026-04-08 | ATT&CK: T1557.001 | Level: HIGH

SELECT
  event_time,
  host,
  user_name,
  process_name,
  parent_process_name,
  command_line,
  sha256,
  'T1557.001'   AS technique,
  'high'        AS confidence
FROM security.process_events
WHERE
  event_time >= NOW() - INTERVAL 7 DAYS
  AND (
    LOWER(process_name) LIKE '%suspicious_proxy.exe%'
    OR (
      LOWER(parent_process_name) LIKE '%explorer.exe'
      AND LOWER(process_name)    LIKE '%suspicious_proxy.exe%'
    )
  )
ORDER BY event_time DESC;

-- ── T1539: Steal Web Session Cookie — Impossible Travel ───────────────────────
-- Note: 203.0.113.47 is RFC 5737 TEST-NET-3 (documentation range, not a real host)
-- Note: aitm-proxy.example.com is RFC 2606 reserved (not a real domain)

SELECT
  event_time,
  user_principal_name,
  app_display_name,
  ip_address,
  location,
  risk_level_during_signin,
  conditional_access_status,
  'T1539'   AS technique,
  'high'    AS confidence
FROM security.signin_logs
WHERE
  event_time >= NOW() - INTERVAL 7 DAYS
  AND (
    ip_address = '203.0.113.47'
    OR LOWER(network_destination) LIKE '%aitm-proxy.example.com%'
  )
ORDER BY event_time DESC;

hunt:
  name: "AiTM Proxy Detection — Infostealer Delivery"
  hypothesis: >
    Threat actors are using adversary-in-the-middle frameworks to intercept credentials
    and deliver infostealer malware via poisoned SSL sessions.
  analyst: "Andre Seguin"
  date: "2026-04-08"
  peak_phase: "Scoped"   # Unscoped | Scoped | Validated

data_sources:
  - name: "Microsoft Defender EDR"
    type: endpoint
    coverage: high
  - name: "Entra ID Sign-in Logs"
    type: identity
    coverage: medium
  - name: "Azure Monitor Network Logs"
    type: network
    coverage: medium

findings:
  - tactic: "Credential Access"
    technique: "T1557.001"
    technique_name: "Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning"
    confirmed: true
    description: >
      Proxy process suspicious_proxy.exe spawned from explorer.exe and established
      outbound TLS connections using a self-signed cert from "Untrusted Root CA".
      Token replay observed in Entra ID logs within 30 seconds of initial auth.
    data_source_ref: "Microsoft Defender EDR"
    iocs:
      - type: process_name
        value: "suspicious_proxy.exe"
      - type: cert_issuer
        value: "Untrusted Root CA"
      - type: parent_process
        value: "explorer.exe"

  - tactic: "Credential Access"
    technique: "T1539"
    technique_name: "Steal Web Session Cookie"
    confirmed: true
    description: >
      Session tokens replayed from anomalous geoip — delta of 8,000+ km in 4 minutes.
      Impossible travel alert correlated with proxy process activity window.
    data_source_ref: "Entra ID Sign-in Logs"
    iocs:
      - type: ip
        # RFC 5737 TEST-NET-3 — documentation address, not a real host
        value: "203.0.113.47"
      - type: domain
        # RFC 2606 reserved — not a real domain
        value: "aitm-proxy.example.com"

verdict: >
  Confirmed attacker activity. Three detections deployed to production covering
  process creation, impossible travel, and C2 beaconing. IR engaged for affected accounts.