Outlook Calendar Event Subject Renamed from Temporary 'd' to Operational C2 Identifier

Duo Tech@duotech

•updated Jul 21, 2026•0•0•1

Detects Microsoft 365 Outlook calendar events being updated via Graph API where the subject is changed to a suspicious C2-like string (e.g., 'Boss Report ID:' or 'Boss update ID:'). This behavior is consistent with attackers using Outlook calendar events as a covert communication channel or for command and control signaling.