Threat Hunt: APT35 - Subtle Snail - Office-Browser Spawn of Executable from User Paths with File Creation
Detects high-fidelity execution of executables spawned from Office applications or browsers after engaging with recruitment-themed lures (e.g., LinkedIn, careers). Focuses on EXE files created and executed within 24 hours in user directories (Downloads, Temp, AppData), reflecting Subtle Snail’s social engineering and document-based initial access methods.
Microsoft Sentinel (KQL)
