NOBELIUM - wide scale APT29 spear-phishing

On May 27, 2021, Microsoft reported a wide scale spear phishing campaign attributed to APT29, the same threat actor responsible for the SolarWinds campaign named SolarStorm. This attack had a wide range of targets for an APT spear phishing campaign with 3,000 email accounts targeted within 150 organizations. https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ This playbook includes the following tasks: - Collect IOCs to be used in your threat hunting process - Query FW, SIEMs, EDR, XDR to detect malicious hashes, network activity and compromised hosts - Block known indicators ** Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

Rapid Breach Response · 34 tasks · 4 inputs · 0 outputs

Inputs

  • EWSSearchQuery — The EWS query to find malicious emails related to NOBELIUM spear-phishing.
  • BlockIndicatorsAutomatically — Whether to automatically indicators involved with NOBELIUM spear-phishing.
  • UserVerification — Possible values: True/False. Whether to provide user verification for blocking IPs. False - No prompt will be displayed to the user. True - The server will ask the user for blocking verification and will display the blocking list.
  • AutoBlockIndicators — |- Should the given indicators be automatically blocked, or should the user be given the option to choose? If set to True - no prompt will appear, and all provided indicators will be blocked automatically. If set to False - the user will be prompted to select which indicators to block.

Commands used

ews-search-mailbox extractIndicators setIndicators

Flowchart

yes yes yes Start Start Collect Indicators of Compromise Collect Indicators of Com... Retrieve IOCs file from Azure GitHub repository - http Retrieve IOCs file from A... http Retrieve Volexity blog - ParseHTMLIndicators Retrieve Volexity blog ParseHTMLIndicators Hunt Indicators Hunt Indicators Extract IOCS from Volexity blog - extractIndicators Extract IOCS from Volexit... extractIndicators Extract IOCs from Azure GitHub repository - extractIndicators Extract IOCs from Azure G... extractIndicators Palo Alto Networks - Hunting And Threat Detection - Palo Alto Networks - Hunting And Threat Detection Palo Alto Networks - Hunt... Palo Alto Networks - Hunting ... SIEM Indicators Hunting SIEM Indicators Hunting Network Activity Indicators Hunt Network Activity Indicato... Panorama Query Logs - Panorama Query Logs Panorama Query Logs Panorama Query Logs QRadar Indicator Hunting V2 - QRadar Indicator Hunting V2 QRadar Indicator Hunting V2 QRadar Indicator Hunting V2 Splunk Indicator Hunting - Splunk Indicator Hunting Splunk Indicator Hunting Splunk Indicator Hunting Search XDR incidents related to NOBELIUM - SearchIncidentsV2 Search XDR incidents rela... SearchIncidentsV2 Endpoints Activity Hunt Endpoints Activity Hunt Search Endpoints By Hash - Generic V2 - Search Endpoints By Hash - Generic V2 Search Endpoints By Hash ... Search Endpoints By Hash - Ge... Is Cortex XDR enabled? Is Cortex XDR enabled? Advanced Hunting Advanced Hunting Run YARA rules Run YARA rules Run Sigma rules Run Sigma rules Cortex XDR XQL queries Cortex XDR XQL queries Malicious Email Search Malicious Email Search Is EWS enabled? Is EWS enabled? Search for emails from spoofed accounts - ews-search-mailbox Search for emails from sp... ews-search-mailbox Block Indicators Block Indicators Block indicators automatically? Block indicators automati... Done Done Block indicators manually Block indicators manually Tag Indicators Tag Indicators Tag File indicators - setIndicators Tag File indicators setIndicators Tag IP indicators - setIndicators Tag IP indicators setIndicators Tag Domain indicators - setIndicators Tag Domain indicators setIndicators Tag URL indicators - setIndicators Tag URL indicators setIndicators Block Indicators - Generic v3 - Block Indicators - Generic v3 Block Indicators - Generi... Block Indicators - Generic v3