Microsoft Graph API Calendar C2 Activity
Detects anomalous Microsoft Graph API activity targeting calendar events and attachments, indicative of the HOLLOWGRAPH C2 protocol. The rule identifies application identity accounts using non-browser user agents to perform suspicious operations (e.g., creating events with future-dated timestamps, specific subject tag formats like 'Boss{..}ID{..}' or 'Event ID:', and file attachments named 'File{n}.txt'). This pattern suggests the use of a compromised M365 mailbox as a two-way dead-drop for C2 and data exfiltration.
Cortex XDR
