Antino Backdoor Abuses Outlook and OneDrive for C2: Detection and Hardening Guide for China-Nexus Espionage Campaign

---
title: Suspicious Process Network Connection to Microsoft 365 API Endpoints
id: 3f7a2b91-8c4d-4e1f-a6b2-9d5e7c1a8f34
status: experimental
description: Detects non-Office, non-browser processes establishing network connections to Microsoft Graph, Outlook, or OneDrive API endpoints. Consistent with Antino-style C2 abusing Microsoft 365 services as observed in the China-nexus espionage campaign targeting Asian government entities.
references:
  - https://thehackernews.com/2026/10/antino-backdoor-uses-outlook-and.html
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_destination:
    DestinationHostname|contains:
      - 'graph.microsoft.com'
      - 'outlook.office365.com'
      - 'outlook.office.com'
      - '-my.sharepoint.com'
      - 'graph.microsoft.us'
      - 'graph.microsoft.de'
  filter_known_processes:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\outlook.exe'
      - '\onedrive.exe'
      - '\onedrivestandaloneupdater.exe'
      - '\filecoauth.exe'
      - '\teams.exe'
      - '\ms-teams.exe'
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\lync.exe'
      - '\msteams.exe'
      - '\searchprotocolhost.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_destination and not filter_known_processes
falsepositives:
  - Legitimate third-party backup, DLP, or eDiscovery tools integrating with Microsoft 365
  - Custom line-of-business applications using Graph API
level: high
---
title: Unsigned Binary in User Profile Connecting to Cloud Storage or Mail APIs
id: 8b3e5c24-1f6a-4d9e-b7c3-2a8f4e6d9b15
status: experimental
description: Detects executables running from user-writable directories (AppData, ProgramData, Temp) making network connections to cloud mail or file storage services. Antino-class implants commonly reside in user profile paths while tunneling C2 through trusted SaaS.
references:
  - https://thehackernews.com/2026/10/antino-backdoor-uses-outlook-and.html
  - https://attack.mitre.org/techniques/T1102/002/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.command_and_control
  - attack.t1102.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Users\Public\'
  selection_cloud:
    DestinationHostname|contains:
      - 'graph.microsoft.com'
      - 'outlook.office365.com'
      - 'sharepoint.com'
      - 'onedrive'
      - 'mail.google.com'
      - 'dropbox.com'
  filter_onedrive_client:
    Image|endswith:
      - '\AppData\Local\Microsoft\OneDrive\OneDrive.exe'
  condition: selection_path and selection_cloud and not filter_onedrive_client
falsepositives:
  - Portable applications syncing to cloud storage
  - User-installed sync utilities
level: high
---
title: Office Application Spawning Script or Command Interpreter
id: 5c9d1f73-2e8b-4a6c-9d4f-7b1e3a5c8d26
status: experimental
description: Detects Office productivity applications spawning command shells or script interpreters. A common delivery and execution chain for implants like Antino following spear-phish initial access against government targets.
references:
  - https://thehackernews.com/2026/10/antino-backdoor-uses-outlook-and.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\msaccess.exe'
      - '\mspub.exe'
      - '\visio.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate macro-driven workflows (finance templates, ERP integrations)
level: high

let M365ApiHosts = dynamic(["graph.microsoft.com", "outlook.office365.com", "outlook.office.com", "graph.microsoft.us", "substrate.office.com"]);
let KnownClients = dynamic(["msedge.exe", "chrome.exe", "firefox.exe", "outlook.exe", "onedrive.exe", "filecoauth.exe", "ms-teams.exe", "msteams.exe", "teams.exe", "winword.exe", "excel.exe", "powerpnt.exe", "searchprotocolhost.exe"]);
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where ActionType == "ConnectionSuccess"
| where RemoteUrl has_any (M365ApiHosts) or RemoteUrl endswith "sharepoint.com"
| where InitiatingProcessFileName !in~ (KnownClients)
| where InitiatingProcessFileName !in~ ("powershell.exe", "pwsh.exe")  // admin Graph usage; hunt separately
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath,
    InitiatingProcessSHA256, InitiatingProcessCommandLine, InitiatingProcessAccountName,
    RemoteUrl, RemoteIP, RemotePort
| extend SuspiciousPath = iff(InitiatingProcessFolderPath has_any ("\\AppData\\", "\\ProgramData\\", "\\Users\\Public\\", "\\Temp\\"), "HIGH", "REVIEW")
| sort by SuspiciousPath asc, TimeGenerated desc

AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName == "Consent to application"
| mv-expand TargetResources
| mv-expand TargetResources.modifiedProperties
| where TargetResources.modifiedProperties.displayName == "ConsentType"
| extend ConsentPerms = tostring(TargetResources.modifiedProperties.newValue)
| where ConsentPerms has_any ("Mail.Read", "Mail.ReadWrite", "Mail.Send", "Files.ReadWrite", "Files.ReadWrite.All", "offline_access")
| project TimeGenerated, AppName = tostring(TargetResources.displayName), AppId = tostring(TargetResources.id),
    ConsentPerms, InitiatedBy = tostring(InitiatedBy.user.userPrincipalName), Result
| sort by TimeGenerated desc

-- Hunt: Processes with active connections to Microsoft 365 API/C2-capable endpoints
-- Deploy as a hunt across endpoints; flag any non-allow-listed process
LET allowlist = ('outlook.exe', 'onedrive.exe', 'msedge.exe', 'chrome.exe',
                 'firefox.exe', 'ms-teams.exe', 'teams.exe', 'filecoauth.exe',
                 'winword.exe', 'excel.exe', 'powerpnt.exe', 'searchprotocolhost.exe')

SELECT Pid, Name, CommandLine, Exe, Username,
       netstat().RemoteIP AS RemoteIP,
       netstat().RemotePort AS RemotePort,
       netstat().Status AS ConnStatus
FROM pslist()
WHERE Name.ToLower() NOT IN allowlist
  AND netstat().RemotePort IN (443, 993, 995)
  AND netstat().Status =~ 'ESTAB'
ORDER BY Username, Pid

# Antino-style M365 C2 Exposure Audit & Hardening
# Run as Global Admin / Cloud App Admin. Review before enforcing.

Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All","AuditLog.Read.All","Policy.ReadWrite.PermissionGrant"

# 1. Enumerate all service principals holding high-risk mail/file Graph permissions
$riskyScopes = @("Mail.Read","Mail.ReadWrite","Mail.Send","Files.ReadWrite.All","Files.Read.All","Sites.ReadWrite.All")
$spGrants = Get-MgServicePrincipal -All | ForEach-Object {
    $sp = $_
    Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id -All -ErrorAction SilentlyContinue |
        Where-Object { $s = $_.Scope; $riskyScopes | Where-Object { $s -match $_ } } |
        Select-Object @{N='AppDisplayName';E={$sp.DisplayName}}, @{N='AppId';E={$sp.AppId}},
                      @{N='ConsentType';E={$_.ConsentType}}, Scope, ClientId, ResourceId
}
$spGrants | Format-Table -AutoSize
$spGrants | Export-Csv -Path "C:\IR\M365_RiskyConsentGrants.csv" -NoTypeInformation
Write-Host "[+] $($spGrants.Count) high-risk consent grants exported for review." -ForegroundColor Yellow

# 2. Find user-consented (non-admin) grants — the classic illicit-consent implant pattern
$userConsents = $spGrants | Where-Object { $_.ConsentType -eq 'Principal' }
$userConsents | Format-Table -AutoSize
if ($userConsents) { Write-Host "[!] USER-CONSENTED grants found — investigate each for implant persistence." -ForegroundColor Red }

# 3. Audit: disable user app consent entirely (recommended for targeted sectors)
# Uncomment after stakeholder review:
# Update-MgPolicyAuthorizationPolicy -DefaultUserRolePermissions @{ PermissionGrantPoliciesAssigned = @() }
# Write-Host "[+] User consent to applications disabled. Admin consent workflow now required." -ForegroundColor Green

# 4. Revoke a confirmed-malicious grant (replace IDs from investigation):
# Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId "<GrantId>"
# Remove-MgServicePrincipal -ServicePrincipalId "<SPObjectId>"

# 5. Verify mailbox auditing is tenant-enforced (detects implant mail access patterns)
Connect-ExchangeOnline
$notAudited = Get-Mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox |
    Where-Object { -not $_.AuditEnabled } | Select-Object UserPrincipalName
if ($notAudited) {
    Write-Host "[!] $($notAudited.Count) mailboxes lack auditing. Enabling tenant-wide:" -ForegroundColor Red
    Set-OrganizationConfig -AuditDisabled $false
}

# 6. Alert policy check — ensure MailItemsAccessed (E5) or owner/delegate access alerts exist
Get-ProtectionAlert | Where-Object { $_.Name -match 'MailItemsAccessed|Mailbox' } |
    Select-Object Name, Disabled, NotificationEnabled | Format-Table -AutoSize

# 7. Endpoint sweep: unsigned binaries in user-writable paths with network capability indicators
$suspectPaths = @("$env:ProgramData", "$env:PUBLIC", "$env:TEMP")
Get-ChildItem -Path $suspectPaths -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue |
    Where-Object { (Get-AuthenticodeSignature $_.FullName).Status -ne 'Valid' } |
    Select-Object FullName, Length, LastWriteTime,
        @{N='SigStatus';E={(Get-AuthenticodeSignature $_.FullName).Status}} |
    Export-Csv "C:\IR\UnsignedBinaries_UserPaths.csv" -NoTypeInformation
Write-Host "[+] Unsigned binary sweep complete. Correlate against network telemetry." -ForegroundColor Yellow