Silk Typhoon Suspicious File Downloads.

Hunt Hypothesis

Adversaries may use suspicious file downloads to exfiltrate data or deploy malware, leveraging the Exchange HttpProxy AOBGeneratorLog to bypass traditional detection. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential data exfiltration or initial compromise attempts.

KQL Query

let scriptExtensions = dynamic([".php", ".jsp", ".js", ".aspx", ".asmx", ".asax", ".cfm", ".shtml"]);
http_proxy_oab_CL
| where RawData contains "Download failed and temporary file"
| extend File = extract("([^\\\\]*)(\\\\[^']*)",2,RawData)
| extend Extension = strcat(".",split(File, ".")[-1])
| extend InteractiveFile = iif(Extension in (scriptExtensions), "Yes", "No")
// Uncomment the following line to alert only on interactive file download type
//| where InteractiveFile =~ "Yes"
| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)

Analytic Rule Definition

id: 03e04c97-8cae-48b3-9d2f-4ab262e4ffff
name: Silk Typhoon Suspicious File Downloads.
description: |
  'This query looks for messages related to file downloads of suspicious file types. This query uses the Exchange HttpProxy AOBGeneratorLog, you will need to onboard this log as a custom log under the table http_proxy_oab_CL before using this query. 
  Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
severity: Medium
requiredDataConnectors: []
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
query: |
  let scriptExtensions = dynamic([".php", ".jsp", ".js", ".aspx", ".asmx", ".asax", ".cfm", ".shtml"]);
  http_proxy_oab_CL
  | where RawData contains "Download failed and temporary file"
  | extend File = extract("([^\\\\]*)(\\\\[^']*)",2,RawData)
  | extend Extension = strcat(".",split(File, ".")[-1])
  | extend InteractiveFile = iif(Extension in (scriptExtensions), "Yes", "No")
  // Uncomment the following line to alert only on interactive file download type
  //| where InteractiveFile =~ "Yes"
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
version: 1.0.3
kind: Scheduled
metadata:
    source:
        kind: Community
    author:
        name: Microsoft Security Research
    support:
        tier: Community
    categories:
        domains: [ "Security - 0-day Vulnerability" ]

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1190 — T1190

References

• Source Query

False Positive Guidance

• Scenario: Legitimate Software Update via Exchange Proxy
  Description: A system administrator is downloading a legitimate software update (e.g., Microsoft Windows Update) through the Exchange proxy, which matches the suspicious file type criteria.
  Filter/Exclusion: Add a filter to exclude file names containing "update", "patch", or "msu" in the FileName field. Example: FileName NOT LIKE '%update%' AND FileName NOT LIKE '%patch%' AND FileName NOT LIKE '%msu%'

• Scenario: Scheduled Backup Job Downloading Archive Files
  Description: A scheduled backup job (e.g., using Veeam or Acronis) is downloading archive files (e.g., .zip, .tar.gz) from a remote server via the Exchange proxy.
  Filter/Exclusion: Exclude file extensions associated with backups, such as .zip, .tar, .gz, or .7z. Example: FileName NOT LIKE '%.zip%' AND FileName NOT LIKE '%.tar%' AND FileName NOT LIKE '%.gz%' AND FileName NOT LIKE '%.7z%'

• Scenario: User Downloading Publicly Available Documentation
  Description: An employee is downloading a public documentation file (e.g., .pdf, .docx) from a company-approved internal repository, which is flagged due to the file type.
  Filter/Exclusion: Exclude file types commonly used for documentation, such as .pdf, .docx, .pptx, or .xlsx. Example: FileName NOT LIKE '%.pdf%' AND FileName NOT LIKE '%.docx%' AND FileName NOT LIKE '%.pptx%' AND FileName NOT LIKE '%.xlsx%'

• Scenario: Admin Performing System Imaging via Remote Tool
  Description: An admin is using a remote imaging tool (e.g., Ghost, Clonezilla) to create a system image, which involves downloading large `.