DarkBlinders Espionage Campaign: Detecting Iran-Aligned Cloud Compromise in Israeli and Kurdish Government Environments

---
title: Suspicious Cloud Console Authentication from Unusual Geographic Location
id: a8f3c2d1-5b4e-4c9a-b7d6-1e2f3a4b5c6d
status: experimental
description: Detects cloud management console access from geographic locations inconsistent with baseline user behavior, potentially indicating compromised credentials used by external threat actors
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/11/06
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  category: authentication
  product: azure
  service: signinlogs
detection:
  selection:
    RiskLevelDuringSignIn: 'high'
    Location|contains:
      - 'IR'
      - 'SY'
      - 'LB'
  filter_known_admins:
    UserPrincipalName|endswith: '@gov.example.com'
    IPAddress|startswith: '10.'
  condition: selection and not filter_known_admins
falsepositives:
  - Legitimate travel by administrative personnel
  - Third-party managed service provider access
level: high
---
title: Cloud Storage Mass Enumeration and Access
id: b7e4d3f2-6a5c-4d8e-c9f0-2e3f4a5b6c7d
status: experimental
description: Detects rapid enumeration and access patterns consistent with systematic data collection from cloud storage repositories, characteristic of espionage-focused exfiltration
references:
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/11/06
tags:
  - attack.collection
  - attack.t1530
logsource:
  category: file_event
  product: azure
  service: storageaccounts
detection:
  selection:
    OperationName|contains:
      - 'ListBlobs'
      - 'GetBlob'
      - 'ListContainers'
  timeframe: 10m
  condition: selection | count() > 100
falsepositives:
  - Legitimate backup operations
  - Automated data lifecycle management
level: medium
---
title: Cloud IAM Policy Modification for Persistence
id: c9f5e4d3-7b6d-4e8f-d0a1-3f4a5b6c7d8e
status: experimental
description: Detects suspicious modifications to cloud Identity and Access Management policies, potentially establishing persistence through privilege escalation or backdoor account creation
references:
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/11/06
tags:
  - attack.persistence
  - attack.t1098
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'New-AzRoleAssignment'
      - 'Set-AzRoleAssignment'
      - 'New- azADUser'
      - 'Update-AzADUser'
  filter_admin_workstations:
    Computer|startswith: 'ADMIN-'
  condition: selection and not filter_admin_workstations
falsepositives:
  - Legitimate administrative automation
  - Identity governance workflows
level: high

// Hunt 1: Anomalous cloud administrative access from high-risk geographies
SigninLogs
| where TimeGenerated >= ago(90d)
| where RiskLevelDuringSignIn in ('high', 'medium')
| where Location in ('IR', 'SY', 'LB')
| where AppDisplayName contains 'Azure' or AppDisplayName contains 'Cloud'
| where ResultType == 0
| summarize 
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    IPAddresses = make_set(IPAddress),
    UserAgents = make_set(UserAgent)
    by UserPrincipalName, AppDisplayName, Location
| extend Duration = LastSeen - FirstSeen
| where Duration > 1d
| project UserPrincipalName, AppDisplayName, Location, FirstSeen, LastSeen, Duration, IPAddresses
| sort by LastSeen desc

// Hunt 2: Mass cloud storage access patterns indicating systematic collection
StorageBlobLogs
| where TimeGenerated >= ago(30d)
| where OperationName in ('ListBlobs', 'GetBlob', 'CopyBlob')
| where ResponseText == 'Success'
| summarize 
    TotalOperations = count(),
    UniqueBlobs = dcount(BlobName),
    ContainerCount = dcount(ContainerName)
    by CallerIpAddress, UserAgentHeader, bin(TimeGenerated, 1h)
| where TotalOperations > 500 or UniqueBlobs > 200
| where ContainerCount > 3
| extend SuspicionScore = TotalOperations / (UniqueBlobs + 1)
| where SuspicionScore > 2
| project TimeGenerated, CallerIpAddress, UserAgentHeader, TotalOperations, UniqueBlobs, SuspicionScore
| sort by SuspicionScore desc

// Hunt 3: Suspicious identity creation and privilege escalation
AuditLogs
| where TimeGenerated >= ago(90d)
| where OperationName in ('Add user', 'Add member to role', 'Update user')
| where Result == 'success'
| where InitiatedBy != 'Unknown'
| extend TargetUser = tostring(TargetResources[0].displayName)
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| where Actor != TargetUser
| summarize 
    Actions = make_set(OperationName),
    ActionCount = count(),
    FirstAction = min(TimeGenerated),
    LastAction = max(TimeGenerated)
    by Actor, TargetUser
| where ActionCount > 3
| where array_length(Actions) > 2
| project Actor, TargetUser, Actions, ActionCount, FirstAction, LastAction
| sort by ActionCount desc

-- Hunt for evidence of cloud credential access and suspicious PowerShell usage
-- targeting Azure/Cloud management interfaces

SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    ParentPid,
    ParentName
FROM pslist()
WHERE 
    CommandLine =~ 'az ad|New-Az|Set-Az|Connect-AzAccount|AzureAD|MSOnline'
    OR CommandLine =~ 'Invoke-RestMethod|Invoke-WebRequest.*management.azure.com'
    OR CommandLine =~ 'token|credential|secret|keyvault'
    AND Username =~ 'admin|svc|system'
ORDER BY CreateTime DESC
LIMIT 100

// Secondary: Network connections to cloud management endpoints
SELECT 
    Pid,
    Name,
    RemoteAddr,
    RemotePort,
    State,
    Timestamp
FROM netstat()
WHERE 
    RemoteAddr =~ '20.190.160.0/19|20.47.0.0/16|52.160.0.0/11'
    OR RemoteAddr =~ 'management.azure.com|graph.microsoft.com|login.microsoftonline.com'
    AND RemotePort == 443
    AND Name !~ 'svchost|lsass|csrss|services|wininit|winlogon'
ORDER BY Timestamp DESC
LIMIT 200

# DarkBlinders Cloud Compromise Assessment and Hardening Script
# Run with administrative privileges in Azure Cloud Shell or elevated PowerShell

Write-Host "=== DarkBlinders Cloud Compromise Assessment ===" -ForegroundColor Cyan
Write-Host "Target: Azure Government/Commercial Cloud Environments" -ForegroundColor Yellow

# Phase 1: Audit recent privileged role assignments
Write-Host "[+] Auditing recent privileged role assignments (last 90 days)..." -ForegroundColor Green

$startDate = (Get-Date).AddDays(-90)
$suspiciousAssignments = Get-AzRoleAssignment | 
    Where-Object { $_.CreatedOn -gt $startDate } | 
    Select-Object DisplayName, SignInName, RoleDefinitionName, Scope, CreatedOn, CreatedBy

if ($suspiciousAssignments) {
    Write-Host "[!] ALERT: $($suspiciousAssignments.Count) recent role assignments detected" -ForegroundColor Red
    $suspiciousAssignments | Format-Table -AutoSize
    $suspiciousAssignments | Export-Csv -Path ".\DarkBlinders_RoleAssignments_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
} else {
    Write-Host "[✓] No recent privileged role assignments detected" -ForegroundColor Green
}

# Phase 2: Audit recent user creation and modification
Write-Host "`n[+] Auditing recent identity creation/modification events..." -ForegroundColor Green

$recentUsers = Get-AzADUser -Filter "createdDateTime ge $($startDate.ToString('yyyy-MM-ddTHH:mm:ssZ'))" | 
    Select-Object DisplayName, UserPrincipalName, CreatedDateTime, AccountEnabled

if ($recentUsers) {
    Write-Host "[!] ALERT: $($recentUsers.Count) recently created users detected" -ForegroundColor Red
    $recentUsers | Format-Table -AutoSize
} else {
    Write-Host "[✓] No recent user creation detected" -ForegroundColor Green
}

# Phase 3: Review conditional access policies for gaps
Write-Host "`n[+] Reviewing Conditional Access policy coverage..." -ForegroundColor Green

$caPolicies = Get-AzConditionalAccessPolicy | 
    Select-Object DisplayName, State, Conditions, GrantControls

$enabledPolicies = $caPolicies | Where-Object { $_.State -eq 'Enabled' }
Write-Host "    Total policies: $($caPolicies.Count), Enabled: $($enabledPolicies.Count)" -ForegroundColor Yellow

# Check for baseline policies
$mfaPolicy = $enabledPolicies | Where-Object { $_.DisplayName -match 'MFA|Multifactor' }
$locationPolicy = $enabledPolicies | Where-Object { $_.DisplayName -match 'Location|Geo' }

if (-not $mfaPolicy) {
    Write-Host "[!] WARNING: No MFA enforcement policy detected" -ForegroundColor Red
    Write-Host "    Recommendation: Deploy MFA for all administrative accounts" -ForegroundColor Yellow
}

if (-not $locationPolicy) {
    Write-Host "[!] WARNING: No geographic location restrictions detected" -ForegroundColor Red
    Write-Host "    Recommendation: Implement location-based access controls" -ForegroundColor Yellow
}

# Phase 4: Audit sign-in logs for suspicious patterns
Write-Host "`n[+] Analyzing sign-in patterns for high-risk access..." -ForegroundColor Green

$signinQuery = @"
SigninLogs
| where TimeGenerated >= ago(30d)
| where RiskLevelDuringSignIn in ('high', 'medium')
| where ResultType == 0
| summarize by UserPrincipalName, IPAddress, Location, AppDisplayName
"@

Write-Host "    Execute this KQL in Microsoft Sentinel for detailed analysis" -ForegroundColor Yellow
Write-Host $signinQuery

# Phase 5: Review storage account access patterns
Write-Host "`n[+] Auditing storage account access configurations..." -ForegroundColor Green

$storageAccounts = Get-AzStorageAccount | Select-Object StorageAccountName, ResourceGroupName, PrimaryLocation, EnableHttpsTrafficOnly

$insecureStorage = $storageAccounts | Where-Object { -not $_.EnableHttpsTrafficOnly }

if ($insecureStorage) {
    Write-Host "[!] ALERT: $($insecureStorage.Count) storage accounts with HTTP enabled" -ForegroundColor Red
    $insecureStorage | Format-Table -AutoSize
    Write-Host "    Immediate action: Disable HTTP traffic on all storage accounts" -ForegroundColor Yellow
} else {
    Write-Host "[✓] All storage accounts enforce HTTPS-only traffic" -ForegroundColor Green
}

# Phase 6: Hardening recommendations
Write-Host "`n[+] Recommended hardening actions:" -ForegroundColor Green
Write-Host "    1. Enable Azure AD Identity Protection with automated risk remediation" -ForegroundColor White
Write-Host "    2. Implement Privileged Identity Management (PIM) for just-in-time access" -ForegroundColor White
Write-Host "    3. Deploy Azure Sentinel with custom analytics for cloud-specific threats" -ForegroundColor White
Write-Host "    4. Enable Azure Defender for Storage with malware scanning" -ForegroundColor White
Write-Host "    5. Review and restrict service principal permissions" -ForegroundColor White

Write-Host "`n=== Assessment Complete ===" -ForegroundColor Cyan