TonRAT Hospitality Campaign: Detecting Fake Guest Complaint Phishing

---
title: Potential TonRAT Phishing Execution via Office
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects Microsoft Office applications spawning PowerShell or CMD, a common pattern in fake guest complaint phishing campaigns leading to TonRAT installation.
references:
  - https://www.microsoft.com/en-us/security/blog/
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
      - '\OUTLOOK.EXE'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
  condition: selection
falsepositives:
  - Legitimate macro usage for document automation
level: high
---
title: Suspicious Registry Run Key Persistence (TonRAT Indicator)
id: 9c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects creation of registry run keys with suspicious parameters often associated with RATs like TonRAT ensuring resilient persistence.
references:
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run'
      - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
    Details|contains:
      - 'powershell.exe -'
      - 'cmd.exe /c'
      - 'http://'
      - 'ftp://'
  condition: selection
falsepositives:
  - Legitimate software installation
level: medium
---
title: Hospitality Phishing Subject Keywords
id: 0d1e2f3a-4b5c-6d7e-8f9a-0b1c2d3e4f5a
status: experimental
description: Detects incoming emails with subject lines associated with the active hospitality fake guest complaint campaign.
references:
  - https://securityaffairs.com/194349/uncategorized/hospitality-sector-hit-by-phishing-campaign-using-fake-guest-complaint-emails.html
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  product: o365
  service: exchange
detection:
  selection:
    Subject|contains:
      - 'Guest Complaint'
      - 'Service Issue'
      - 'Billing Discrepancy'
      - 'Unsatisfied Stay'
  condition: selection
falsepositives:
  - Legitimate guest complaints (requires analyst review)
level: low

// Hunt for suspicious process creation patterns associated with phishing documents
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe")
| where FileName in~ ("powershell.exe", "cmd.exe", "mshta.exe", "wscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc


// Network Beaconing Detection for TonRAT C2
DeviceNetworkEvents
| where Timestamp >= ago(30m)
| where RemotePort in (80, 443, 8080) 
| summarize Count = count(), TimeList = make_list(Timestamp) by DeviceName, RemoteUrl, RemoteIP
| where Count > 50 // High frequency connections indicative of beaconing
| extend BeaconingScore = iff(iff(max(TimeList) - min(TimeList) > 10m, true, false), "High", "Low")
| where BeaconingScore == "High"

-- Hunt for TonRAT persistence mechanisms and suspicious parent processes
SELECT Pid, Name, CommandLine, Exe, Username, ParentPid
FROM pslist()
WHERE Name =~ "cmd.exe" OR Name =~ "powershell.exe"
  AND CommandLine =~ "-Enc" OR CommandLine =~ "Invoke-Expression"

-- Hunt for network connections to non-standard ports or suspicious IPs
SELECT Fd, Family, RemoteAddr, RemotePort, State, Pid
FROM netstat()
WHERE State =~ "ESTABLISHED" AND RemotePort > 1024

# Audit and Remediation Script for Hospitality Endpoints
# Requires Administrative Privileges

Write-Host "[+] Starting Host Audit for TonRAT Indicators..."

# 1. Check for Suspicious Persistence in Registry Run Keys
$suspiciousPaths = @("C:\Windows\Temp\", "C:\Users\Public\", "AppData\Local\Temp")
$runKeys = @("HKLM:\Software\Microsoft\Windows\CurrentVersion\Run", 
             "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce", 
             "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce")

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-Item $key | ForEach-Object {
            $_.Property | ForEach-Object {
                $propValue = (Get-ItemProperty -Path "$key" -Name $_).$_
                if ($suspiciousPaths | Where-Object { $propValue -like "*$_*" }) {
                    Write-Host "[!] Suspicious Persistence Found in $key : $_ = $propValue" -ForegroundColor Red
                    # Remove-ItemProperty -Path $key -Name $_ -Force # Uncomment to remediate
                }
            }
        }
    }
}

# 2. Disable Macros from Internet (GPO enforcement check simulation)
Write-Host "[+] Checking Macro Security Settings..."
$blockSetting = (Get-ItemProperty -Path "HKCU:\Software\Microsoft\Office\16.0\Outlook\Security" -ErrorAction SilentlyContinue).MarkInternalAsUnsafe
if ($blockSetting -ne 1) {
    Write-Host "[!] Warning: Outlook Macro settings may allow external content." -ForegroundColor Yellow
}

Write-Host "[+] Audit Complete. Please review findings."