SkyW4lker Device-Code Phishing Kit: Microsoft 365 OAuth Token Theft Campaign — OTX Detection Pack

---
title: SkyW4lker Phishing Kit - Device Code OAuth Abuse
id: 8f3a9c1e-5b2d-4e7f-9a1c-3d5e7f8a9b1c
status: experimental
description: Detects device-code authentication flow abuse targeting Microsoft 365, indicative of SkyW4lker phishing kit activity
references:
    - https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/
author: Security Arsenal Threat Intel
date: 2026/11/05
modified: 2026/11/05
tags:
    - attack.credential_access
    - attack.t1557.002
    - attack.t1550.001
logsource:
    product: azure
    service: signinlogs
detection:
    selection_flow:
        AuthenticationProtocol: 'deviceCode'
    selection_suspicious:
        - Location|contains:
              - 'Unknown'
              - 'Anonymous'
        - IPAddress|contains:
              - 'TOR'
              - 'VPN'
    selection_phishing_domains:
        - Referrer|contains:
              - '5200m.com'
              - 'fosterswifts.com'
              - 'kuer.online'
              - 'mouphyweb.com'
              - 'off365mail.club'
              - 'eccentric-authentication.com'
              - 'photosofus.com'
              - 'nicewayrealestate.cc'
    condition: selection_flow and (selection_suspicious or selection_phishing_domains)
falsepositives:
    - Legitimate device-code authentication from corporate-managed IoT devices
    - Developers testing OAuth integrations
level: high
---
title: SkyW4lker Phishing Domain DNS Query
id: 7e2b8d1c-4a3f-5e6d-8b2c-4d6e8f9a1b2d
status: experimental
description: Detects DNS queries to known SkyW4lker phishing kit infrastructure domains
references:
    - https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/
author: Security Arsenal Threat Intel
date: 2026/11/05
modified: 2026/11/05
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - '5200m.com'
            - 'fosterswifts.com'
            - 'kuer.online'
            - 'mouphyweb.com'
            - 'off365mail.club'
            - 'eccentric-authentication.com'
            - 'photosofus.com'
            - 'nicewayrealestate.cc'
    condition: selection
falsepositives:
    - Security researchers investigating the campaign
    - Threat intelligence feeds performing automated lookups
level: medium
---
title: Suspicious OAuth Application Consent Grant - Microsoft 365
id: 6d1c7e2b-3f4a-5b6c-7d8e-9f0a1b2c3d4e
status: experimental
description: Detects user consent grants to OAuth applications with high-risk permissions, potential SkyW4lker persistence mechanism
references:
    - https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/
author: Security Arsenal Threat Intel
date: 2026/11/05
modified: 2026/11/05
tags:
    - attack.persistence
    - attack.t1550.001
logsource:
    product: azure
    service: auditlogs
detection:
    selection_operation:
        OperationName:
            - 'Consent to application'
            - 'Add service principal'
    selection_permissions:
        TargetResources|contains:
            - 'Mail.Read'
            - 'Mail.ReadWrite'
            - 'Files.Read.All'
            - 'Files.ReadWrite.All'
            - 'offline_access'
    selection_user:
        InitiatedBy: 'User'
    condition: selection_operation and selection_permissions and selection_user
falsepositives:
    - Legitimate third-party app integrations (Slack, Zoom, etc.)
    - IT-administered service principal creation
level: high

// Microsoft Sentinel KQL Hunt Query - SkyW4lker Device Code Phishing
// Hunt for device-code authentication events and phishing domain connections

let phishing_domains = dynamic([
    "5200m.com",
    "fosterswifts.com",
    "kuer.online",
    "mouphyweb.com",
    "off365mail.club",
    "eccentric-authentication.com",
    "photosofus.com",
    "nicewayrealestate.cc"
]);

// Part 1: Azure AD Sign-in Logs - Device Code Flow
SigninLogs
| where TimeGenerated >= ago(30d)
| where AuthenticationProtocol == "deviceCode"
| extend ParsedLocation = tostring(parse_json(LocationDetails))
| extend Country = tostring(parse_json(ParsedLocation).countryOrRegion)
| extend City = tostring(parse_json(ParsedLocation).city)
| where ResultType == 0  // Successful authentication
| project
    TimeGenerated,
    UserPrincipalName,
    IPAddress,
    Country,
    City,
    UserAgent,
    AppDisplayName,
    DeviceDetail,
    AuthenticationProtocol,
    ConditionalAccessStatus
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count()
    by UserPrincipalName, IPAddress, Country, UserAgent, AppDisplayName
| where Count >= 1
| order by LastSeen desc;

// Part 2: Network connections to known SkyW4lker phishing domains
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteUrl has_any (phishing_domains)
| project
    TimeGenerated,
    DeviceName,
    InitiatingProcessAccountName,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    RemoteUrl,
    RemoteIP,
    RemotePort,
    ActionType
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), ConnectionCount = count()
    by DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| order by LastSeen desc;

// Part 3: Email clicks on phishing domains (requires Office 365 connector)
EmailUrlInfo
| where TimeGenerated >= ago(30d)
| where Url has_any (phishing_domains)
| join kind=inner (
    EmailEvents
    | where TimeGenerated >= ago(30d)
    | project NetworkMessageId, SenderFromAddress, RecipientEmailAddress, Subject, DeliveryAction
) on NetworkMessageId
| project
    TimeGenerated,
    SenderFromAddress,
    RecipientEmailAddress,
    Subject,
    Url,
    DeliveryAction,
    ThreatTypes
| order by TimeGenerated desc;

// Part 4: OAuth application consent grants (persistence check)
AuditLogs
| where TimeGenerated >= ago(30d)
| where OperationName in ("Consent to application", "Add service principal")
| extend InitiatedByUser = tostring(parse_json(InitiatedBy).user.userPrincipalName)
| extend TargetApp = tostring(parse_json(TargetResources)[0].displayName)
| extend Permissions = tostring(parse_json(TargetResources)[0].modifiedProperties)
| where Permissions has_any ("Mail.Read", "Files.ReadWrite", "offline_access")
| project
    TimeGenerated,
    InitiatedByUser,
    TargetApp,
    Permissions,
    IPAddress,
    UserAgent,
    Result
| order by TimeGenerated desc;

<#
.SYNOPSIS
    SkyW4lker Phishing Kit IOC Hunt Script
.DESCRIPTION
    Checks Windows endpoints for indicators of SkyW4lker phishing kit compromise:
    - DNS cache entries for known phishing domains
    - Browser history/artifacts for phishing URLs
    - Suspicious OAuth tokens in browser credential stores
    - Network connections to phishing infrastructure
.NOTES
    Run with elevated privileges for complete visibility.
    Author: Security Arsenal Threat Intel
    Date: 2026-11-05
#>

$ErrorActionPreference = 'SilentlyContinue'

# Known SkyW4lker phishing domains from OTX pulse
$PhishingDomains = @(
    "5200m.com",
    "fosterswifts.com",
    "kuer.online",
    "mouphyweb.com",
    "off365mail.club",
    "eccentric-authentication.com",
    "photosofus.com",
    "nicewayrealestate.cc"
)

Write-Host "[+] SkyW4lker Phishing Kit IOC Hunt - $(Get-Date)" -ForegroundColor Cyan
Write-Host "[+] Hostname: $env:COMPUTERNAME`n" -ForegroundColor Cyan

# ============================================
# CHECK 1: DNS Cache for Phishing Domains
# ============================================
Write-Host "[*] Checking DNS cache for SkyW4lker phishing domains..." -ForegroundColor Yellow

$DNSCache = Get-DnsClientCache | Where-Object {
    $entry = $_.Entry
    $PhishingDomains | Where-Object { $entry -like "*$_*" }
}

if ($DNSCache) {
    Write-Host "[!] ALERT: Suspicious DNS cache entries found:" -ForegroundColor Red
    $DNSCache | Format-Table -AutoSize
} else {
    Write-Host "[+] No suspicious DNS cache entries detected." -ForegroundColor Green
}

# ============================================
# CHECK 2: Active Network Connections to Phishing IPs
# ============================================
Write-Host "`n[*] Checking active network connections..." -ForegroundColor Yellow

# Resolve phishing domains to IPs (best effort - domains may be sinkholed or down)
$PhishingIPs = @()
foreach ($domain in $PhishingDomains) {
    try {
        $IPs = [System.Net.Dns]::GetHostAddresses($domain) | Select-Object -ExpandProperty IPAddressToString
        $PhishingIPs += $IPs
    } catch {
        # Domain may not resolve - this is expected for taken-down infrastructure
    }
}

if ($PhishingIPs.Count -gt 0) {
    $SuspiciousConnections = Get-NetTCPConnection | Where-Object {
        $PhishingIPs -contains $_.RemoteAddress
    }
    
    if ($SuspiciousConnections) {
        Write-Host "[!] ALERT: Active connections to phishing infrastructure:" -ForegroundColor Red
        $SuspiciousConnections | Format-Table -AutoSize
    } else {
        Write-Host "[+] No active connections to known phishing IPs." -ForegroundColor Green
    }
} else {
    Write-Host "[*] Phishing domains did not resolve (may be sinkholed or expired)." -ForegroundColor Yellow
}

# ============================================
# CHECK 3: Browser History Artifacts (Chrome)
# ============================================
Write-Host "`n[*] Checking Chrome browser history for phishing domains..." -ForegroundColor Yellow

$ChromeHistoryPath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History"

if (Test-Path $ChromeHistoryPath) {
    # Copy database to temp location to avoid lock issues
    $TempHistory = "$env:TEMP\ChromeHistory_$(Get-Random).db"
    Copy-Item $ChromeHistoryPath $TempHistory -Force
    
    # Check if SQLite assembly is available (requires System.Data.SQLite or manual query)
    # For this script, we'll do a simple string search in the file
    $HistoryContent = Get-Content $TempHistory -Raw -ErrorAction SilentlyContinue
    
    $FoundDomains = @()
    foreach ($domain in $PhishingDomains) {
        if ($HistoryContent -match $domain) {
            $FoundDomains += $domain
        }
    }
    
    if ($FoundDomains.Count -gt 0) {
        Write-Host "[!] ALERT: Phishing domains found in Chrome history:" -ForegroundColor Red
        $FoundDomains | ForEach-Object { Write-Host "    - $_" -ForegroundColor Red }
    } else {
        Write-Host "[+] No phishing domains found in Chrome history." -ForegroundColor Green
    }
    
    Remove-Item $TempHistory -Force
} else {
    Write-Host "[*] Chrome history not found (may not be installed or different profile)." -ForegroundColor Yellow
}

# ============================================
# CHECK 4: Scheduled Tasks (persistence check)
# ============================================
Write-Host "`n[*] Checking for suspicious scheduled tasks..." -ForegroundColor Yellow

$SuspiciousTasks = Get-ScheduledTask | Where-Object {
    $_.TaskName -match "Microsoft.*Update|Office.*Sync|Auth.*Token" -and
    $_.TaskPath -notlike "\Microsoft\*"
}

if ($SuspiciousTasks) {
    Write-Host "[!] ALERT: Suspicious scheduled tasks found:" -ForegroundColor Red
    $SuspiciousTasks | Format-Table TaskName, TaskPath, State -AutoSize
} else {
    Write-Host "[+] No suspicious scheduled tasks detected." -ForegroundColor Green
}

# ============================================
# CHECK 5: Recent Run Keys (persistence check)
# ============================================
Write-Host "`n[*] Checking registry Run keys for suspicious entries..." -ForegroundColor Yellow

$RunKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
)

$SuspiciousRunEntries = @()
foreach ($key in $RunKeys) {
    if (Test-Path $key) {
        $entries = Get-ItemProperty $key
        $entries.PSObject.Properties | ForEach-Object {
            if ($_.Value -match "powershell|cmd|wscript|cscript" -and $_.Value -match "http|bit\.ly|tinyurl") {
                $SuspiciousRunEntries += [PSCustomObject]@{
                    Key = $key
                    Name = $_.Name
                    Value = $_.Value
                }
            }
        }
    }
}

if ($SuspiciousRunEntries) {
    Write-Host "[!] ALERT: Suspicious Run key entries found:" -ForegroundColor Red
    $SuspiciousRunEntries | Format-Table -AutoSize
} else {
    Write-Host "[+] No suspicious Run key entries detected." -ForegroundColor Green
}

# ============================================
# CHECK 6: Microsoft 365 Device Login Artifacts
# ============================================
Write-Host "`n[*] Checking for device-code authentication artifacts..." -ForegroundColor Yellow

# Check for recent microsoft.com/devicelogin visits in browser history
$DeviceLoginArtifact = $false
if ($HistoryContent -match "microsoft.com/devicelogin") {
    Write-Host "[!] ALERT: microsoft.com/devicelogin found in browser history." -ForegroundColor Red
    Write-Host "    Verify if user initiated legitimate device pairing (smart TV, IoT device)." -ForegroundColor Yellow
    $DeviceLoginArtifact = $true
} else {
    Write-Host "[+] No device-code login artifacts found in browser history." -ForegroundColor Green
}

# ============================================
# SUMMARY
# ============================================
Write-Host "`n========================================" -ForegroundColor Cyan
Write-Host "SkyW4lker IOC Hunt Complete" -ForegroundColor Cyan
Write-Host "========================================" -ForegroundColor Cyan

$FindingsCount = ($DNSCache.Count + $SuspiciousConnections.Count + $FoundDomains.Count + $SuspiciousTasks.Count + $SuspiciousRunEntries.Count)

if ($FindingsCount -gt 0 -or $DeviceLoginArtifact) {
    Write-Host "[!] SUSPICIOUS ACTIVITY DETECTED - $FindingsCount findings" -ForegroundColor Red
    Write-Host "    Recommended actions:" -ForegroundColor Yellow
    Write-Host "    1. Isolate host from network" -ForegroundColor Yellow
    Write-Host "    2. Force password reset for affected user" -ForegroundColor Yellow
    Write-Host "    3. Revoke all OAuth tokens for user in Azure AD" -ForegroundColor Yellow
    Write-Host "    4. Review Azure AD sign-in logs for anomalous activity" -ForegroundColor Yellow
    Write-Host "    5. Check for unauthorized OAuth app registrations" -ForegroundColor Yellow
} else {
    Write-Host "[+] No indicators of SkyW4lker compromise detected." -ForegroundColor Green
}

Write-Host "`n[*] Hunt completed at $(Get-Date)" -ForegroundColor Cyan