← Back to SOC feed Coverage →

Excel file download domain pattern

kql MEDIUM Azure-Sentinel
DeviceNetworkEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-04-25T09:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use a malicious domain to host an Excel file that, when downloaded, leads users to a phishing page or installs malware. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage BazaCall campaign activity before users are compromised.

KQL Query

DeviceNetworkEvents
| where RemoteUrl matches regex @".{14}\.xyz/config\.php"

Analytic Rule Definition

id: 1dd47f50-d42d-4e2f-9c2b-6e6c22147916
name: Excel file download domain pattern
description: |
  BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader.
  This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
tactics:
- Initial access
query: |
  DeviceNetworkEvents
  | where RemoteUrl matches regex @".{14}\.xyz/config\.php"

Required Data Sources

Sentinel TableNotes
DeviceNetworkEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Campaigns/Bazacall/Excel file download domain pattern.yaml