Project CAV3RN - logAzure.txt Hardcoded Entra Config Drop

Georg Lauenstein@gsec

•updated Jul 27, 2026•1•0•12

Detects creation of logAzure.txt, the relative configuration file the Project CAV3RN AzureCommunication.dll module reads and writes to the process's current working directory. On first run the module has no such file, so it serializes its hardcoded Microsoft Entra tenant ID, application client ID/secret, target mailbox, DNS bootstrap host, and RSA key pair to this exact filename before establishing Microsoft Graph C2. Its presence on disk is a durable artifact of this specific implant.