HollowGraph C2: Detecting Microsoft 365 Graph API Abuse via Future-Dated Calendar Events

Security operations teams must adapt to a sophisticated new evasion technique observed in the wild. Researchers at Group-IB have detailed "HollowGraph," an espionage implant that weaponizes the trust placed in Microsoft 365. Rather than establishing a distinct, noisy command-and-control (C2) TCP channel, HollowGraph leverages the native Microsoft Graph API to embed operator instructions and exfiltrate sensitive data directly within calendar events.

The operative mechanism involves planting tasks and smuggling out stolen files as attachments on calendar events scheduled for the year 2050. By using a legitimate API endpoint (graph.microsoft.com) and blending into normal tenant traffic, this attack bypasses traditional network perimeter defenses that look for anomalies in external IP connections or non-standard protocols. For defenders, the urgency is clear: if your organization relies solely on network-layer inspection to spot data exfiltration, you are currently blind to this vector.

Technical Analysis

Affected Platforms:

Microsoft 365 (Exchange Online)
Microsoft Graph API

The Attack Chain:

Initial Access: The implant gains a foothold on a user endpoint, likely via credential theft or initial access malware, allowing it to harvest valid OAuth tokens or session cookies.
C2 Communication (Tasking): The malware queries the Microsoft Graph API for calendar events. It specifically looks for events dated far in the future (specifically 2050). The text body or metadata of these events contains encrypted instructions from the attacker.
Data Exfiltration: To send data back to the operators, the malware creates or modifies future-dated events, attaching stolen files (e.g., documents, databases) to the event object.
Persistence: Because the traffic utilizes the user's valid authentication context and communicates with a trusted Microsoft domain, firewall and proxy logs generally show only encrypted TLS traffic to graph.microsoft.com, making traffic analysis futile without deep SSL inspection and API-specific logging.

Exploitation Status:

Confirmed Active Exploitation: Group-IB has identified HollowGraph in active espionage campaigns. It is not theoretical; it is a current, operational threat.
CVE Status: N/A (This is an abuse of functionality, not a software vulnerability).

Detection & Response

Detecting HollowGraph requires a shift in telemetry focus from network flows to application-level logging and behavioral analysis. We are hunting for anomalies in the timing and content of API calls, not just the existence of the calls themselves.

SIGMA Rules

The following Sigma rules target the specific network artifacts and process behaviors indicative of HollowGraph-like activity.

YAML

---
title: Potential HollowGraph Graph API Activity via Future Dates
id: 8a2c9f10-1b3d-4c5e-9f6a-7b8d9e0f1a2b
status: experimental
description: Detects potential HollowGraph C2 activity by identifying process execution patterns often associated with Graph API automation interacting with endpoints containing future dates like 2050. This rule focuses on command-line arguments used by scripting engines.
references:
  - https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\python.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_cli:
    CommandLine|contains:
      - 'graph.microsoft.com'
      - 'outlook.office.com'
  selection_indicator:
    CommandLine|contains:
      - '2050'
      - '2049'
      - '2048'
  condition: all of selection_*
falsepositives:
  - Legacy script testing (rare)
  - Administrative scheduling scripts (verify year context)
level: high
---
title: Suspicious Network Connection to Graph Microsoft with High Year Context
id: 9b3d0a21-2c4e-5d6f-0a7b-8c9e1f2a3b4c
status: experimental
description: Detects network connections to Microsoft Graph API where the URI contains year indicators significantly in the future (2050), indicative of HollowGraph evasion techniques.
references:
  - https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.exfiltration
  - attack.t1567.001
logsource:
  category: proxy
  product: zeek
  definition: 'Requirements: Zeek HTTP or DNS logs containing full URI query'
detection:
  selection:
    host|contains: 'graph.microsoft.com'
    uri|contains:
      - '2050'
      - 'startDateTime'
  condition: selection
falsepositives:
  - Legitimate administrative errors
  - Testing of API limits
level: critical

KQL (Microsoft Sentinel)

This hunt query targets the OfficeActivity table to find calendar manipulations involving dates in the distant future.

KQL — Microsoft Sentinel / Defender

OfficeActivity
| where Operation in ("New-CalendarEvent", "Update-CalendarEvent", "Set-CalendarEvent")
| extend Year = extract(@"(\d{4})", 1, tostring(CalculatedItemFields))
| where isnotempty(Year) and toint(Year) > 2026
| project TimeGenerated, UserId, ClientIP, Operation, Year, Parameters, ObjectId
| order by TimeGenerated desc

Velociraptor VQL

Use this artifact to hunt for processes on the endpoint actively establishing connections to the Microsoft Graph API, correlating them with the user context to identify potential imposters.

VQL — Velociraptor

-- Hunt for processes connecting to Graph API
SELECT Pid, Name, CommandLine, Username, CreateTime
FROM process_graph(target_pid=pid)
WHERE Name =~ 'powershell.exe'
   OR Name =~ 'python.exe'
   OR Name =~ 'node.exe'
   OR Name =~ 'cmd.exe'

-- Correlate with network connections to graph.microsoft.com
SELECT conn.Pid, conn.RemoteAddress, conn.RemotePort, p.Name, p.CommandLine, p.Username
FROM netstat() AS conn
JOIN pslist() AS p ON conn.Pid = p.Pid
WHERE conn.RemoteAddress =~ 'graph.microsoft.com'
   AND conn.State = 'ESTABLISHED'

Remediation Script (PowerShell)

This script assists incident responders in auditing a specific user's calendar for events scheduled beyond the current operational year, a key indicator of HollowGraph compromise. Note: Requires Exchange Online PowerShell module or appropriate Graph API permissions.

PowerShell

# Audit Calendar for Future-Dated Events (HollowGraph Indicator)
# Usage: .\Audit-HollowGraph.ps1 -UserPrincipalName "target@domain.com"

param(
    [Parameter(Mandatory=$true)]
    [string]$UserPrincipalName
)

Write-Host "[*] Checking for Calendar Events dated 2027 or later for user: $UserPrincipalName" -ForegroundColor Cyan

try {
    # Using Exchange Online cmdlets (requires Connect-ExchangeOnline)
    $calendarEvents = Get-ExoCalendarEvent -UserPrincipalName $UserPrincipalName -ErrorAction Stop
    
    $currentYear = Get-Date -Format "yyyy"
    $suspiciousEvents = $calendarEvents | Where-Object { $_.Start.DateTime -gt "$currentYear-12-31" }

    if ($suspiciousEvents) {
        Write-Host "[!] ALERT: Found suspicious future-dated events!" -ForegroundColor Red
        foreach ($event in $suspiciousEvents) {
            Write-Host "--------------------------------------------------"
            Write-Host "Subject: $($event.Subject)"
            Write-Host "Start:  $($event.Start.DateTime)"
            Write-Host "End:    $($event.End.DateTime)"
            Write-Host "Has Attachments: $($event.HasAttachments)"
            Write-Host "ID: $($event.Id)"
        }
        Write-Host "[+] Action Required: Review event contents and attachments immediately." -ForegroundColor Yellow
    } else {
        Write-Host "[+] No suspicious future-dated events found." -ForegroundColor Green
    }
}
catch {
    Write-Error "Error querying calendar: $_"
    Write-Host "Ensure you are connected to Exchange Online (Connect-ExchangeOnline)."
}

Remediation

If HollowGraph or similar Graph API abuse is detected in your environment, immediate containment and eradication are required:

Identity Compromise Response: The presence of this malware implies valid credentials or session tokens have been stolen. Immediately force a password reset and terminate all active sessions for the affected user(s) via the Microsoft 365 Admin Center (Revoke sign-in sessions in the user properties).
Audit and Revoke OAuth Permissions: Review the "Enterprise applications" and "App registrations" in Entra ID (formerly Azure AD). Revoke any non-standard or suspicious application permissions granted to the user's account. Look for apps with high-privilege Graph API permissions (Calendars.ReadWrite, Files.ReadWrite.All) that were not formally approved.
Conditional Access Enforcement: Implement strict Conditional Access policies that require:
- Compliant Devices: Only devices managed by Intune or compliant with your security baseline can access Exchange Online.
- Location/Anti-Fraud: Block access from impossible travel scenarios or unknown risky locations.
Remove Malicious Artifacts: Use the provided PowerShell script to locate and manually delete the "2050" events. Ensure you inspect and preserve any attachments found within these events as evidence (and to determine what data was exfiltrated).
Enable Unified Audit Logging (UAL): Ensure UAL is enabled for all users. While it is on by default, misconfigurations occur. This is the only source of truth for identifying these API-level manipulations.
Microsoft Sentinel Rules: Deploy the provided KQL query as a Scheduled Query Rule in Sentinel to alert on any calendar creation/modification events where the year is greater than the current year.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub