Cloud Hopper

Hunt Hypothesis

Adversaries may use long-term, low-privilege access to maintain persistence within cloud environments, leveraging compromised credentials to move laterally and exfiltrate data over extended periods. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential long-term data exfiltration and lateral movement by advanced persistent threats.

KQL Query

DeviceProcessEvents 
| where Timestamp > ago(7d)
| where FileName =~ @"cscript.exe" and ProcessCommandLine has ".vbs /shell "
| top 100 by Timestamp desc

Analytic Rule Definition

id: 8c54c0f3-fbd4-426b-8f58-363efbdc09fa
name: Cloud Hopper
description: |
  Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_cloudhopper.yml.
  Questions via Twitter: @janvonkirchheim.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(7d)
  | where FileName =~ @"cscript.exe" and ProcessCommandLine has ".vbs /shell "
  | top 100 by Timestamp desc

Required Data Sources

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Campaigns/Cloud Hopper.yaml)

False Positive Guidance

• Scenario: Legitimate Cloud Backup Job Using AWS CLI
  Description: A scheduled job runs aws s3 cp to back up on-premises data to an S3 bucket.
  Filter/Exclusion: process.name:*aws* AND process.args:*s3 cp* AND process.args:*--region*

• Scenario: Admin Task Using Azure CLI for Resource Management
  Description: An administrator uses az vm list or az storage account list to manage Azure resources.
  Filter/Exclusion: process.name:*az* AND process.args:*list* AND process.args:*--resource-group*

• Scenario: Scheduled Job Using PowerShell for Log Rotation
  Description: A PowerShell script runs Get-ChildItem and Move-Item to rotate logs in a shared directory.
  Filter/Exclusion: process.name:pwsh OR process.name:PowerShell AND process.args:*Get-ChildItem* AND process.args:*Move-Item*

• Scenario: Legitimate Use of Docker for Container Management
  Description: A DevOps engineer uses docker ps or docker images to manage running containers.
  Filter/Exclusion: process.name:*docker* AND process.args:*ps* OR process.args:*images*

• Scenario: System Maintenance Task Using Windows Task Scheduler
  Description: A task scheduled via Task Scheduler runs net use to map a network drive for backup purposes.
  Filter/Exclusion: process.name:net AND process.args:*use* AND process.args:*/persistent:no*