Knight Office AiTM Phishing Kit: M365 Session Token Theft Campaign — OTX Pulse Analysis & Detection Pack

---
title: Suspicious M365 OAuth Consent Grant Following Sign-In
description: Detects user consent to OAuth applications, a persistence technique used by Knight Office AiTM phishing kit operators after session token theft
date: 2026/09/03
status: experimental
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        OperationName:
            - 'Consent to application'
            - 'Add service principal'
    condition: selection
level: high
tags:
    - attack.persistence
    - attack.t1528
    - attack.t1550
---
title: Windows Hello for Business or Device Registration Anomaly
description: Detects device registration/join and WHfB key enrollment events potentially indicating Knight Office post-compromise persistence after AiTM session theft
date: 2026/09/03
status: experimental
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        OperationName:
            - 'Add registered device'
            - 'Update device'
            - 'Add strong authentication method'
            - 'Register security info'
    filter_known:
        Result: 'success'
    condition: selection and filter_known
level: high
tags:
    - attack.persistence
    - attack.t1098
    - attack.t1556
---
title: Outbound Connection to Knight Office AiTM Phishing Infrastructure
description: Detects DNS resolution or web connections to known Knight Office .vu phishing kit domains identified in OTX pulse
date: 2026/09/03
status: experimental
logsource:
    category: dns
detection:
    selection_domains:
        query:
            - 'kleepxrnlinecorporation.vu'
            - 'advancedplacyncement.vu'
            - 'amstardmzsmc.vu'
            - 'arandasoftzfdware.vu'
            - 'avisoretentiunionllc.vu'
            - 'capitalflwxinancialpartners.vu'
            - 'certififiycationedge.vu'
            - 'connectivnqzityltd.vu'
    selection_tld:
        query|endswith: '.vu'
    condition: selection_domains or selection_tld
level: critical
tags:
    - attack.initial_access
    - attack.t1566
    - attack.t1557

// Knight Office AiTM hunt: network hits + post-compromise identity behavior
let knightDomains = dynamic(["kleepxrnlinecorporation.vu","advancedplacyncement.vu","amstardmzsmc.vu","arandasoftzfdware.vu","avisoretentiunionllc.vu","capitalflwxinancialpartners.vu","certififiycationedge.vu","connectivnqzityltd.vu"]);
let SuspectHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (knightDomains) or RemoteUrl endswith ".vu"
| project HitTime=TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteUrl, InitiatingProcessFileName;
SuspectHits
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName in~ ("chrome.exe","msedge.exe","firefox.exe","iexplore.exe")
    | project ProcTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine
) on DeviceName
| where ProcTime between (datetime_add('minute', -10, HitTime) .. datetime_add('minute', 10, HitTime))
| project HitTime, DeviceName, AccountName, RemoteUrl, ProcessCommandLine
| sort by HitTime desc;
// Identity-side: session replay / impossible travel after suspicious sign-in
// SigninLogs
// | where TimeGenerated > ago(14d)
// | where ResultType == 0
// | summarize Signins=count(), Locations=make_set(Location), ASNs=make_set(NetworkLocationDetails) by UserPrincipalName, bin(TimeGenerated, 1h)
// | where array_length(Locations) > 1

# Knight Office AiTM IOC Hunt — run across endpoints via EDR/Intune/GPO
# Checks DNS cache and proxy telemetry for .vu phishing infrastructure

$knightDomains = @(
    "kleepxrnlinecorporation.vu",
    "advancedplacyncement.vu",
    "amstardmzsmc.vu",
    "arandasoftzfdware.vu",
    "avisoretentiunionllc.vu",
    "capitalflwxinancialpartners.vu",
    "certififiycationedge.vu",
    "connectivnqzityltd.vu"
)

Write-Host "=== Knight Office AiTM IOC Hunt ===" -ForegroundColor Cyan

# 1. DNS client cache check
$dnsHits = Get-DnsClientCache | Where-Object {
    $_.Entry -match '\.vu$' -or ($knightDomains | ForEach-Object { $_ -eq $_.Entry })
}
if ($dnsHits) {
    Write-Host "[!] SUSPICIOUS DNS CACHE ENTRIES:" -ForegroundColor Red
    $dnsHits | Format-Table Entry, RecordType, Data -AutoSize
} else { Write-Host "[+] DNS cache clean" -ForegroundColor Green }

# 2. Active network connections to .vu-hosted infrastructure
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($c in $conns) {
    try {
        $rdns = (Resolve-DnsName -Name $c.RemoteAddress -Type PTR -ErrorAction Stop).NameHost
        if ($rdns -match '\.vu$') {
            $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
            Write-Host "[!] Active connection to .vu host: $rdns ($($c.RemoteAddress)) by $($proc.ProcessName)" -ForegroundColor Red
        }
    } catch {}
}

# 3. Check Entra ID device registration artifacts (local evidence of rogue device join)
$dsreg = & dsregcmd.exe /status 2>$null
if ($dsreg -match 'AzureAdJoined\s*:\s*YES') {
    $joinTime = ($dsreg | Select-String 'DeviceCertificateValidity').ToString()
    Write-Host "[i] Device is Entra-joined. Verify join was user-initiated and expected." -ForegroundColor Yellow
    Write-Host "    Cross-reference recent device registrations in Entra audit logs for this user."
}

# 4. Browser history sweep (Chrome/Edge) for known kit domains
$histPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
)
foreach ($p in $histPaths) {
    if (Test-Path $p) {
        Write-Host "[i] Browser history DB present: $p — submit for forensic parsing (look for .vu domains + docusign/monday.com redirect chains)" -ForegroundColor Yellow
    }
}

Write-Host "=== Hunt complete. Escalate any [!] findings to IR immediately ===" -ForegroundColor Cyan