HollowGraph Malware: Detecting Microsoft Graph API Abuse in M365 Calendars

---
title: HollowGraph Suspicious M365 Calendar Update Frequency
id: 85d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects potential HollowGraph activity by identifying high-frequency updates to M365 calendar events via Graph API, indicative of C2 check-ins.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.command_and_control
  - attack.t1071.004
logsource:
  product: o365
  service: audit_general
detection:
  selection:
    Operation|contains:
      - 'UpdateCalendarEvents'
      - 'CalendarEvents Update'
  filter_legitimate:
    UserId|contains:
      - 'service.account' # Exclude known automation accounts
  condition: selection | count() by UserId > 10 # Threshold: 10 updates in 15 mins
timeframe: 15m
falsepositives:
  - Power users managing calendar busy schedules
  - Synchronization tools acting on behalf of users
level: high
---
title: HollowGraph Graph API Access from Non-Standard User-Agent
id: 92e1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects Microsoft Graph API access to Calendar resources using user agents not associated with standard Office clients, often indicative of custom malware.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  product: o365
  service: audit_general
detection:
  selection:
    Operation|contains:
      - 'CalendarEvents'
    ClientAppId|startswith: '00000003-0000-0000-c000-000000000000' # Microsoft Office 365 Exchange Online
  filter_office_clients:
    ClientUA|contains:
      - 'Microsoft Office'
      - 'Outlook'
      - 'MacOutlook'
      - 'iOS'
      - 'Android'
  condition: selection and not filter_office_clients
falsepositives:
  - Custom internal scripts using Graph SDKs
  - Third-party calendar integrations (e.g., Zoom, Salesforce)
level: medium

OfficeActivity
| where TimeGenerated > ago(1h)
| where Operation has_any ("CalendarEvents", "UpdateCalendarEvents")
| extend UserPrincipalName = tostring(UserId)
| extend ClientIP = parse_(ClientIP)[0] // Handle complex IP objects if present
| summarize Count = count(), DistinctIPs = dcount(ClientIP), Operations = makeset(Operation) by UserPrincipalName, bin(TimeGenerated, 10m)
| where Count > 5 // Threshold tuning required based on environment baseline
| project TimeGenerated, UserPrincipalName, Count, DistinctIPs, Operations
| order by Count desc

-- Hunt for non-standard processes connecting to Microsoft Graph API
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Pid IN (
    SELECT Pid
    FROM netstat()
    WHERE RemoteAddress =~ 'graph.microsoft.com'
      AND RemotePort == 443
)
  AND NOT Name =~ '(Outlook.exe|chrome.exe|msedge.exe|firefox.exe|teams.exe|excel.exe|winword.exe|powershell.exe|pwsh.exe)'
  AND NOT Exe =~ '(C:\Program Files\.*|C:\Program Files (x86)\.*)'

<#
.SYNOPSIS
  Investigator Script: Identify suspicious Graph API connections on endpoint.
.DESCRIPTION
  Identifies processes connecting to graph.microsoft.com and exports process details for IR triage.
#>

Write-Host "[+] Initiating HollowGraph Endpoint Hunt..." -ForegroundColor Cyan

$suspiciousConnections = Get-NetTCPConnection -RemoteAddress (Resolve-DnsName -Name "graph.microsoft.com" -Type A | Select-Object -First 1 -ExpandProperty IPAddress) -ErrorAction SilentlyContinue

if ($suspiciousConnections) {
    Write-Host "[!] Found active connections to graph.microsoft.com:" -ForegroundColor Yellow
    
    foreach ($conn in $suspiciousConnections) {
        try {
            $process = Get-Process -Id $conn.OwningProcess -ErrorAction Stop
            
            # Filter out common legitimate paths (heuristic)
            $legitPaths = @("Program Files", "Program Files (x86)", "Windows", "WindowsApps")
            $isLegit = $false
            foreach ($path in $legitPaths) {
                if ($process.Path -like "*$path*") { $isLegit = $true; break }
            }

            if (-not $isLegit) {
                Write-Host "    SUSPICIOUS PROCESS DETECTED:" -ForegroundColor Red
                Write-Host "    PID: $($process.Id)"
                Write-Host "    Name: $($process.ProcessName)"
                Write-Host "    Path: $($process.Path)"
                Write-Host "    Command Line: $($process.StartInfo.Arguments)"
                
                # Collect parent process info
                $parent = Get-Process -Id $process.ParentId -ErrorAction SilentlyContinue
                Write-Host "    Parent PID: $($parent.Id) ($($parent.ProcessName))"
            }
        }
        catch {
            Write-Host "    Could not resolve details for PID $($conn.OwningProcess) (Process may have terminated)."
        }
    }
} else {
    Write-Host "[-] No active connections to graph.microsoft.com found." -ForegroundColor Green
}

Write-Host "[+] Hunt complete. Review findings for HollowGraph artifacts."