Wazza Device Code Phishing Kit + GCP LLMjacking Campaign: OTX Pulse Analysis — Microsoft 365 & Cloud Credential Theft Detection Pack

---
title: Microsoft 365 Device Code Flow Authentication From Suspicious Source
description: Detects OAuth device code authentication events in Entra ID indicative of Wazza-style device code phishing, where victims are tricked into authorizing attacker sessions.
status: experimental
author: Security Arsenal Threat Intel
logsource:
    product: azure
    service: signinlogs
detection:
    selection_flow:
        authentication_protocol: 'deviceCode'
    selection_risk:
        risk_level_aggregated: 'high'
        is_interactive: false
    filter_known:
        ip_address|startswith:
            - '10.'
            - '192.168.'
    condition: selection_flow and not filter_known
fields:
    - user_principal_name
    - ip_address
    - user_agent
    - app_display_name
falsepositives:
    - Legitimate device code logins for CLI tools (Azure CLI, PowerShell, VS Code) from corporate IPs
level: high
tags:
    - attack.initial_access
    - attack.t1566
    - attack.t1550.001
    - attack.t1528
date: 2026/10/21
---
title: GCP Organization Policy Guardrail Disabled Followed by Service Account Creation
description: Detects LLMjacking post-compromise behavior — organizational policy modification to disable security constraints followed by service account creation and external IAM grants.
status: experimental
author: Security Arsenal Threat Intel
logsource:
    product: gcp
    service: audit
detection:
    selection_policy:
        method_name: 'SetOrgPolicy'
    selection_policy_keys:
        constraint|contains:
            - 'iam.allowedPolicyMemberDomains'
            - 'iam.disableServiceAccountCreation'
            - 'iam.disableServiceAccountKeyCreation'
    selection_iam:
        method_name:
            - 'CreateServiceAccount'
            - 'SetIamPolicy'
            - 'CreateServiceAccountKey'
    timeframe: 1h
    condition: selection_policy and selection_policy_keys and selection_iam
fields:
    - principal_email
    - method_name
    - resource_name
    - caller_ip
falsepositives:
    - Terraform/administrative automation performing legitimate policy and IAM changes
level: critical
tags:
    - attack.defense_evasion
    - attack.t1562
    - attack.persistence
    - attack.t1136
    - attack.impact
    - attack.t1496
date: 2026/10/21
---
title: Network Connection to Wazza Phishing Kit Infrastructure
description: Detects endpoint network connections to known Wazza device code phishing kit domains and Cloudflare Workers relay hostnames identified in OTX pulses.
status: experimental
author: Security Arsenal Threat Intel
logsource:
    category: dns
detection:
    selection_domain:
        query|contains:
            - 'beton-beton.eu'
            - 'bike-msca.eu'
            - 'bodi-project.eu'
            - 'bruoth-family.eu'
            - 'cardamomo.eu'
            - 'coppietersrecherche.eu'
            - 'diabetesnet.eu'
            - 'beacon-surge-sync.workers.dev'
            - 'groosl.com'
            - 'groonl.com'
            - 'gboogl.com'
            - 'gbrokl.space'
            - 'gbrokl.xyz'
            - 'gcoalg.com'
            - 'gcslom.com'
    condition: selection_domain
fields:
    - query
    - answer
    - src_ip
falsepositives:
    - Unlikely; these are purpose-built phishing domains
level: critical
tags:
    - attack.initial_access
    - attack.t1566.002
    - attack.command_and_control
    - attack.t1071.001
date: 2026/10/21

// Hunt: Device code phishing (Wazza) + typosquat infrastructure + suspicious OAuth flows
// Microsoft Sentinel — 14 day lookback
let PhishIOCs = dynamic([
    "beton-beton.eu","bike-msca.eu","bodi-project.eu","bruoth-family.eu",
    "cardamomo.eu","coppietersrecherche.eu","diabetesnet.eu",
    "beacon-surge-sync.workers.dev","groosl.com","groonl.com","gboogl.com",
    "gbrokl.space","gbrokl.xyz","gcoalg.com","gcslom.com"
]);
let PhishHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (PhishIOCs) or RemoteIP == "212.73.134.136"
| project PhishTime=TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, LocalIP;
// Correlate endpoint phishing contact with Entra device code sign-ins
let DeviceCodeSignins = SigninLogs
| where TimeGenerated > ago(14d)
| where AuthenticationProtocol == "deviceCode" or tostring(AuthenticationDetails) has "device code"
| extend IsRisky = iff(RiskLevelDuringSignIn in ("high","medium") or IPAddress !startswith "10.", true, false)
| project SigninTime=TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, IsRisky, Location;
PhishHits
| join kind=inner (DeviceCodeSignins) on $left.LocalIP == $right.IPAddress
| where abs((SigninTime - PhishTime)) < 2h
| project PhishTime, SigninTime, DeviceName, UserPrincipalName, RemoteUrl, IPAddress, AppDisplayName, IsRisky, Location
| order by SigninTime desc

# Security Arsenal — Wazza + LLMjacking IOC Hunt Script
# Checks: DNS cache, proxy-adjacent artifacts, Entra token artifacts, suspicious inbox rules
# Run elevated on endpoints; pair with Entra ID / GCP audit log review

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

$PhishDomains = @(
    'beton-beton.eu','bike-msca.eu','bodi-project.eu','bruoth-family.eu',
    'cardamomo.eu','coppietersrecherche.eu','diabetesnet.eu',
    'beacon-surge-sync.workers.dev','groosl.com','groonl.com','gboogl.com',
    'gbrokl.space','gbrokl.xyz','gcoalg.com','gcslom.com'
)
$PhishIP = '212.73.134.136'

Write-Host "[*] Checking DNS client cache for phishing infrastructure..." -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache
foreach ($d in $PhishDomains) {
    $hit = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hit) { $report += [pscustomobject]@{Check='DNSCache'; IOC=$d; Detail=$hit.Data; Severity='CRITICAL'} }
}

Write-Host "[*] Checking active/historical TCP connections to phishing IP..." -ForegroundColor Cyan
$conns = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq $PhishIP }
if ($conns) {
    foreach ($c in $conns) {
        $proc = Get-Process -Id $c.OwningProcess
        $report += [pscustomobject]@{Check='NetworkConnection'; IOC=$PhishIP; Detail="$($proc.ProcessName) (PID $($c.OwningProcess)) -> $($c.RemoteAddress):$($c.RemotePort)"; Severity='CRITICAL'}
    }
}

Write-Host "[*] Checking browser history databases for phishing domains (Chrome/Edge)..." -ForegroundColor Cyan
$historyPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
)
foreach ($hp in $historyPaths) {
    if (Test-Path $hp) {
        $tmp = Join-Path $env:TEMP ("hist_" + [guid]::NewGuid().ToString('N'))
        Copy-Item $hp $tmp -Force
        $raw = [System.IO.File]::ReadAllBytes($tmp)
        $txt = [System.Text.Encoding]::ASCII.GetString($raw)
        foreach ($d in $PhishDomains) {
            if ($txt -match [regex]::Escape($d)) {
                $report += [pscustomobject]@{Check='BrowserHistory'; IOC=$d; Detail="Found in $hp"; Severity='HIGH'}
            }
        }
        Remove-Item $tmp -Force
    }
}

Write-Host "[*] Checking for suspicious Office 365 token cache artifacts (possible token theft)..." -ForegroundColor Cyan
$msalCache = "$env:LOCALAPPDATA\.IdentityService"
$wamPaths = @("$env:LOCALAPPDATA\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy")
foreach ($p in @($msalCache) + $wamPaths) {
    if (Test-Path $p) {
        $recent = Get-ChildItem $p -Recurse -Force | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-3) }
        if ($recent) {
            $report += [pscustomobject]@{Check='TokenCacheActivity'; IOC='MSAL/WAM cache'; Detail="$($recent.Count) token artifacts modified in last 72h — correlate with device code sign-in logs"; Severity='MEDIUM'}
        }
    }
}

Write-Host "[*] Checking for Outlook inbox rules indicating post-compromise persistence..." -ForegroundColor Cyan
$rulesPath = "HKCU:\Software\Microsoft\Office\16.0\Outlook\Profiles"
if (Test-Path $rulesPath) {
    $report += [pscustomobject]@{Check='InboxRules'; IOC='N/A'; Detail='Outlook profile present — export rules via Graph: GET /me/mailFolders/inbox/messageRules and audit for forwarding/deletion rules'; Severity='INFO'}
}

Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($report.Count -gt 0) {
    $report | Sort-Object Severity | Format-Table -AutoSize
    $report | Export-Csv -Path ".\wazza_llmjack_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[*] Results exported to CSV. CRITICAL/HIGH hits: isolate host and begin identity response." -ForegroundColor Red
} else {
    Write-Host "[+] No indicators found on this host. Continue identity-log correlation in Sentinel." -ForegroundColor Green
}

Write-Host "`n[*] MANUAL FOLLOW-UP (cloud side):" -ForegroundColor Cyan
Write-Host "    Entra: Search-UnifiedAuditLog for 'device code' flows; revoke refresh tokens via Revoke-MgUserSignInSession"
Write-Host "    GCP: gcloud logging read 'protoPayload.methodName=(SetOrgPolicy OR CreateServiceAccount)' --freshness=7d"