BigBear 2.0 Evilginx2 PhaaS Campaign: AiTM Microsoft 365 Credential Theft — OTX Detection Pack

---
title: Outbound Connection to BigBear 2.0 Evilginx2 AiTM Phishing Infrastructure
id: 7c3f1a2e-9b4d-4e1f-a8c6-2d5b7f0e9a11
status: experimental
description: Detects DNS resolution or network connections to known BigBear 2.0 / Evilginx2 adversary-in-the-middle phishing proxy domains and hosting IPs observed in the 'General Boss' PhaaS campaign targeting Microsoft 365 credentials.
references:
    - https://www.cloudsek.com/blog/tracking-bigbear-2-0-evilginx2-phishing-campaign
author: Security Arsenal Threat Intelligence
date: 2026/09/08
tags:
    - attack.credential_access
    - attack.t1557
    - attack.t1557.002
    - attack.t1566
    - attack.t1566.002
logsource:
    category: dns
product: windows
selection:
    QueryName|contains:
        - 'dronalms.com'
        - 'ccpipharma.com'
        - 'knowncontractor.com'
        - 'hnospascualfadon.com'
condition: selection
falsepositives:
    - Threat intelligence platform enrichment lookups
level: high
---
title: Microsoft 365 Sign-In From Anonymous or Proxy ASN Following Session Token Issuance
id: 8d4e2b3f-0c5e-5f2a-b9d7-3e6c8a1f0b22
status: experimental
description: Detects Entra ID sign-in patterns consistent with AiTM session token replay - successful authentication from hosting provider or proxy ASNs (e.g., Vultr/Choopa, Constant) with new device or unfamiliar session characteristics, indicative of Evilginx2/BigBear 2.0 credential theft and MFA bypass via stolen cookies.
references:
    - https://www.cloudsek.com/blog/tracking-bigbear-2-0-evilginx2-phishing-campaign
author: Security Arsenal Threat Intelligence
date: 2026/09/08
tags:
    - attack.credential_access
    - attack.t1557.002
    - attack.t1539
    - attack.t1078
    - attack.t1078.004
logsource:
    product: azure
    service: signinlogs
selection:
    network_asn|contains:
        - 'CHOOPLA'
        - 'AS20473'
        - 'Vultr'
        - 'Constant Company'
    status: 'Success'
condition: selection
falsepositives:
    - Users legitimately working from VPN providers or corporate egress hosted on VPS infrastructure
    - IT administrator testing from cloud hosts
level: high
---
title: Suspicious Inbox Forwarding Rule Creation Following Suspected AiTM Compromise
id: 9e5f3c4a-1d6f-6a3b-c0e8-4f7d9b2a1c33
status: experimental
description: Detects creation of mailbox inbox rules that forward, redirect, or delete messages - a common post-compromise action after BigBear 2.0/Evilginx2 session theft enables BEC and internal phishing pivots from the hijacked mailbox.
references:
    - https://www.cloudsek.com/blog/tracking-bigbear-2-0-evilginx2-phishing-campaign
author: Security Arsenal Threat Intelligence
date: 2026/09/08
tags:
    - attack.collection
    - attack.t1114
    - attack.t1114.003
    - attack.persistence
    - attack.t1098
logsource:
    product: office365
    service: exchange
selection:
    Operation:
        - 'New-InboxRule'
        - 'Set-InboxRule'
    Parameters|contains:
        - 'ForwardTo'
        - 'RedirectTo'
        - 'ForwardAsAttachmentTo'
        - 'DeleteMessage'
condition: selection
falsepositives:
    - Legitimate user-created forwarding rules for approved business workflows
level: medium

// BigBear 2.0 / Evilginx2 AiTM Phishing Infrastructure Hunt — Microsoft Sentinel
// Hunts endpoint network events and DNS for known campaign IOCs, then pivots to identity impact
let PhishDomains = dynamic(["dronalms.com","ccpipharma.com","knowncontractor.com","hnospascualfadon.com"]);
let PhishIPs = dynamic(["130.94.113.184","130.94.82.180","130.94.82.230","38.54.124.58"]);
let NetHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has_any (PhishDomains) or RemoteIP in (PhishIPs)
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
let DnsHits =
    DeviceEvents
    | where TimeGenerated > ago(90d)
    | where ActionType == "DnsQueryResponse"
    | extend AdditionalFields = parse_json(AdditionalFields)
    | extend DnsQuery = tostring(AdditionalFields.DnsQueryString)
    | where DnsQuery has_any (PhishDomains)
    | project TimeGenerated, DeviceName, DnsQuery;
let ImbibedUsers = NetHits | distinct InitiatingProcessAccountName;
NetHits
| union DnsHits
| order by TimeGenerated desc;
// Pivot: check whether users who hit the phishing infra show anomalous M365 sign-ins
SigninLogs
| where TimeGenerated > ago(90d)
| where UserPrincipalName has_any (ImbibedUsers)
| where ResultType == 0
| extend NetworkDetails = tostring(parse_json(NetworkLocationDetails))
| where NetworkDetails has_any ("Choopa","Vultr","AS20473","Constant")
   or IPAddress in (PhishIPs)
| project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName,
          DeviceDetail, NetworkDetails, AuthenticationRequirement, SessionId
| order by TimeGenerated desc

<#
.SYNOPSIS
    BigBear 2.0 / Evilginx2 AiTM Phishing IOC & Exposure Hunt Script
.DESCRIPTION
    Hunts Windows endpoints for evidence of user interaction with known BigBear 2.0
    phishing infrastructure (General Boss PhaaS campaign, OTX pulse 2026-09-08).
    Checks DNS client cache, browser history artifacts, proxy/network connections,
    and flags users requiring immediate credential + session revocation.
    Run elevated on suspect endpoints, or deploy fleet-wide via your EDR/remote shell.
#>

$PhishDomains = @('dronalms.com','ccpipharma.com','knowncontractor.com','hnospascualfadon.com')
$PhishIPs     = @('130.94.113.184','130.94.82.180','130.94.82.230','38.54.124.58')
$findings = @()

Write-Host "[*] BigBear 2.0 AiTM Phishing Hunt — $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Cyan

# --- 1. DNS client cache for phishing domain resolution ---
Write-Host "[*] Checking DNS client cache..." -ForegroundColor Yellow
try {
    $dns = Get-DnsClientCache -ErrorAction Stop
    foreach ($d in $PhishDomains) {
        $hits = $dns | Where-Object { $_.Entry -like "*$d*" }
        if ($hits) {
            $findings += [pscustomobject]@{Check='DNS Cache'; Indicator=$d; Detail=($hits | Select-Object -First 1 | Out-String).Trim(); Risk='HIGH'}
            Write-Host "  [!] DNS cache hit: $d" -ForegroundColor Red
        }
    }
} catch { Write-Host "  [-] DNS cache query failed: $_" -ForegroundColor DarkGray }

# --- 2. Active/historical TCP connections to phishing IPs ---
Write-Host "[*] Checking network connections to phishing IPs..." -ForegroundColor Yellow
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $PhishIPs -contains $_.RemoteAddress }
if ($conns) {
    foreach ($c in $conns) {
        $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
        $findings += [pscustomobject]@{Check='Net Connection'; Indicator=$c.RemoteAddress; Detail="PID $($c.OwningProcess) ($($proc.ProcessName)) state $($c.State)"; Risk='CRITICAL'}
        Write-Host "  [!!] Active connection to $($c.RemoteAddress) by $($proc.ProcessName)" -ForegroundColor Red
    }
}

# --- 3. Browser history artifacts (Chrome/Edge) for phishing domain visits ---
Write-Host "[*] Checking browser history artifacts..." -ForegroundColor Yellow
$histPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
)
foreach ($hp in $histPaths) {
    if (Test-Path $hp) {
        $tmp = Join-Path $env:TEMP ("hist_" + [guid]::NewGuid().ToString('N') + ".db")
        Copy-Item $hp $tmp -Force -ErrorAction SilentlyContinue
        foreach ($d in $PhishDomains) {
            if ((Get-Content $tmp -Raw -ErrorAction SilentlyContinue) -match [regex]::Escape($d)) {
                $findings += [pscustomobject]@{Check='Browser History'; Indicator=$d; Detail="Found in $hp"; Risk='HIGH'}
                Write-Host "  [!] Browser history artifact: $d in $hp" -ForegroundColor Red
            }
        }
        Remove-Item $tmp -Force -ErrorAction SilentlyContinue
    }
}

# --- 4. Proxy auto-config / system proxy tampering check ---
Write-Host "[*] Checking for proxy tampering..." -ForegroundColor Yellow
$proxyKey = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings'
$proxy = Get-ItemProperty -Path $proxyKey -ErrorAction SilentlyContinue
if ($proxy.ProxyEnable -eq 1 -and $proxy.ProxyServer -notmatch '^(localhost|127\.)' -and -not $proxy.ProxyServer.StartsWith($env:USERDOMAIN)) {
    $findings += [pscustomobject]@{Check='Proxy Config'; Indicator=$proxy.ProxyServer; Detail='Non-standard user proxy configured - validate legitimacy'; Risk='MEDIUM'}
}

# --- 5. Recent logon events indicating possible session misuse (local side) ---
Write-Host "[*] Pulling recent successful logons for correlation with Entra ID..." -ForegroundColor Yellow
$logons = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-14)} -MaxEvents 500 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+10' } | Select-Object -First 20
if ($logons) { Write-Host "  [i] $($logons.Count) remote logons in last 14 days — correlate with Entra sign-in logs" -ForegroundColor Cyan }

# --- Summary ---
Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Cyan
if ($findings.Count -gt 0) {
    $findings | Format-Table -AutoSize
    $findings | Export-Csv -Path ".\BigBear2_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[!] $($findings.Count) finding(s) exported. ESCALATE: revoke user sessions + reset credentials immediately." -ForegroundColor Red
} else {
    Write-Host "[+] No BigBear 2.0 indicators found on this endpoint." -ForegroundColor Green
}