Year-End Credential Harvesting Campaign: SharePoint & DocuSign Impersonation Phishing Infrastructure — OTX Pulse Analysis

---
title: Phishing Lure Access to Impersonated SharePoint/DocuSign Infrastructure
id: 9f3a2c71-4e5b-4d6a-8c1f-20261025yr01
status: experimental
description: Detects network connections to known year-end phishing lure infrastructure identified in OTX pulse 2026 Year End Phishing Lures, including abused Japanese hosting IPs and throwaway phishing domains.
author: Security Arsenal Threat Intelligence
references:
  - https://www.netcraft.com/blog/year-end-phishing-lures-fake-raises-q4-invoices-and-access-reviews
date: 2026/10/25
logsource:
  category: network_connection
detection:
  selection_ip:
    DestinationIp:
      - 157.7.189.101
      - 157.7.44.119
      - 118.20.84.128
      - 123.98.253.31
  selection_domain:
    DestinationHostname|contains:
      - rsfashionsdesignbd.com
      - bvlbetonvloeren.be
      - englaus.sbs
      - tropical100.com.do
  condition: 1 of selection_*
falsepositives:
  - Rare legitimate browsing to compromised hosts; investigate context of connection initiator process
level: high
tags:
  - attack.initial_access
  - attack.t1566
---
title: Suspicious Browser or Office Process Spawning Credential Entry Followed by External HTTPS POST
id: 9f3a2c71-4e5b-4d6a-8c1f-20261025yr02
status: experimental
description: Detects browser or Office processes launched from email clients that initiate HTTPS POST traffic to low-reputation or newly observed domains, consistent with phishing kit credential exfiltration from SharePoint/DocuSign impersonation pages.
author: Security Arsenal Threat Intelligence
date: 2026/10/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\OUTLOOK.EXE'
      - '\thunderbird.exe'
      - '\msedgewebview2.exe'
  selection_child:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate links opened from email; tune by correlating with proxy logs for suspicious TLDs (.sbs, .top, .xyz)
level: medium
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.t1204.001
---
title: OAuth Consent Grant or Inbox Rule Creation Following Phish-Linked Login
id: 9f3a2c71-4e5b-4d6a-8c1f-20261025yr03
status: experimental
description: Detects post-compromise persistence behaviors associated with credential phishing — suspicious inbox forwarding rules or new OAuth application consent shortly after anomalous sign-in, commonly observed after SharePoint/DocuSign lure credential theft.
author: Security Arsenal Threat Intelligence
date: 2026/10/25
logsource:
  product: azure
  service: auditlogs
detection:
  selection_oauth:
    OperationName:
      - 'Consent to application'
      - 'Add service principal'
  selection_inboxrule:
    OperationName|contains:
      - 'New-InboxRule'
      - 'Set-InboxRule'
  filter_known:
    InitiatedBy|contains:
      - 'admin@'
  condition: (selection_oauth or selection_inboxrule) and not filter_known
falsepositives:
  - Legitimate application onboarding or user-created mail rules; validate with user confirmation workflow
level: high
tags:
  - attack.persistence
  - attack.t1098.001
  - attack.t1550
  - attack.collection
  - attack.t1114.003

// Hunt for year-end phishing lure infrastructure access and follow-on compromise
// OTX Pulse: 2026 Year End Phishing Lures (TLP:WHITE)
let PhishIPs = dynamic(["157.7.189.101","157.7.44.119","118.20.84.128","123.98.253.31"]);
let PhishDomains = dynamic(["rsfashionsdesignbd.com","bvlbetonvloeren.be","englaus.sbs","tropical100.com.do"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (PhishIPs) or RemoteUrl has_any (PhishDomains)
| project NetworkHitTime=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ActionType;
let EmailContext = EmailEvents
| where TimeGenerated > ago(30d)
| where Subject has_any ("raise","compensation","invoice","Q4","access review","benefits","DocuSign","shared a file")
| project EmailTime=TimeGenerated, RecipientEmailAddress, Subject, SenderFromAddress, AttachmentCount;
NetworkHits
| join kind=leftouter (DeviceLogonEvents
    | where TimeGenerated > ago(30d)
    | summarize PostPhishLogons=count(), LogonTypes=make_set(LogonType) by DeviceName, AccountName) on DeviceName
| join kind=leftouter EmailContext on $left.DeviceName == $right.RecipientEmailAddress // adjust join key per tenant schema
| project NetworkHitTime, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, PostPhishLogons, AccountName, Subject, SenderFromAddress
| order by NetworkHitTime desc

# =============================================================
# Year-End Phishing Lure - Endpoint IOC & Compromise Hunt
# OTX Pulse: 2026 Year End Phishing Lures (TLP:WHITE)
# Checks browser artifacts, DNS cache, auth artifacts, and mail rules
# =============================================================

$PhishIPs     = @('157.7.189.101','157.7.44.119','118.20.84.128','123.98.253.31')
$PhishDomains = @('rsfashionsdesignbd.com','bvlbetonvloeren.be','englaus.sbs','tropical100.com.do')

Write-Host '[*] Checking DNS client cache for phishing domains...' -ForegroundColor Cyan
Get-DnsClientCache | Where-Object {
    $entry = $_.Entry
    ($PhishDomains | Where-Object { $entry -like "*$_*" }) -or ($PhishIPs -contains $_.Data)
} | Format-Table Entry, Data, TimeToLive -AutoSize

Write-Host '[*] Checking active/historical TCP connections to phishing IPs...' -ForegroundColor Cyan
Get-NetTCPConnection | Where-Object { $PhishIPs -contains $_.RemoteAddress } |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess |
    Format-Table -AutoSize

Write-Host '[*] Checking Chrome/Edge history for lure page visits (last 30 days)...' -ForegroundColor Cyan
$historyPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
)
foreach ($hp in $historyPaths) {
    if (Test-Path $hp) {
        $copy = Join-Path $env:TEMP ('hist_' + (Get-Random) + '.db')
        Copy-Item $hp $copy -Force -ErrorAction SilentlyContinue
        # Requires sqlite3 or use PSSQLite module; fallback: string-scan raw bytes
        $bytes = [System.IO.File]::ReadAllText($copy)
        foreach ($d in $PhishDomains) {
            if ($bytes -match [regex]::Escape($d)) {
                Write-Host "[!] HIT: $d found in browser history: $hp" -ForegroundColor Red
            }
        }
        Remove-Item $copy -Force -ErrorAction SilentlyContinue
    }
}

Write-Host '[*] Checking Windows Credential Manager for suspicious recent entries...' -ForegroundColor Cyan
cmdkey /list | Select-String -Pattern 'sharepoint|docusign|office' -Context 0,2

Write-Host '[*] Reviewing recent failed/successful logons (Event 4624/4625) for anomalies...' -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624,4625; StartTime=(Get-Date).AddDays(-14)} -MaxEvents 500 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Logon Type:\s+(3|10)' } |
    Select-Object TimeCreated, Id, @{n='Snippet';e={$_.Message.Substring(0,[Math]::Min(200,$_.Message.Length))}} |
    Format-List

Write-Host '[*] Checking for suspicious Outlook inbox rules via registry (client-side)...' -ForegroundColor Cyan
$profilePath = 'HKCU:\Software\Microsoft\Office\16.0\Outlook\Profiles'
if (Test-Path $profilePath) {
    Get-ChildItem $profilePath -Recurse -ErrorAction SilentlyContinue |
        Where-Object { $_.Property -match 'Rule' } |
        Select-Object PSChildName, Property | Format-Table -AutoSize
}

Write-Host '[*] Hunt complete. Correlate any hits with proxy/EDR telemetry and force credential resets for exposed users.' -ForegroundColor Green