Encrypted C2 Results Uploaded via Outlook Calendar Event Attachments

Duo Tech@duotech

•updated Jul 21, 2026•1•0•2

Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.