Account-Verification and Browser OTP Services on Corporate Assets

A source that reaches 2fa.live, or several of the listed services, is worth checking against the issued-machine inventory; macOS hosts rely on the DnsEvents branch where Defender omits the URL.

// Parent = the last two labels of the host, so any subdomain of a listed domain matches.
union
  (DeviceNetworkEvents
    | where Timestamp > ago(90d) and isnotempty(RemoteUrl)
    | project Timestamp, Source = DeviceName, Name = RemoteUrl),
  (DnsEvents
    | where TimeGenerated > ago(90d)
    | project Timestamp = TimeGenerated, Source = ClientIP, Name)
| extend Parent = extract(@"^(?:[a-z][a-z0-9+.-]*://)?(?:[^/:?#]*\.)?([^./:?#]+\.[^./:?#]+)\.?(?:[:/?#]|$)", 1, tolower(Name))
| where Parent in~ (
    // optional: the six pre-hire services are lower fidelity; delete this line and the next
    "sms-man.com", "sms-activate.org", "mailforspam.com", "slynumber.com", "hushed.com", "ssn-check.org",
    "2fa.live")
| summarize Lookups = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Domains = make_set(Parent) by Source
| order by array_length(Domains) desc, Lookups desc

The same match over DNS logs, grouped by client so a source reaching several services sorts first.

```Placeholder: index=dns carries the CIM DNS field query; for proxy data use the host field your proxy extracts.```
index=dns earliest=-90d
| eval query=lower(query)
| rex field=query "(?<parent>[^.]+\.[^.]+)\.?$"
| where parent IN (
    ```optional: the six pre-hire services are lower fidelity; delete this line and the next```
    "sms-man.com", "sms-activate.org", "mailforspam.com", "slynumber.com", "hushed.com", "ssn-check.org",
    "2fa.live")
| stats count AS lookups min(_time) AS first_seen max(_time) AS last_seen dc(parent) AS services values(parent) AS domains BY src
| convert ctime(first_seen) ctime(last_seen)
| sort - services, - lookups

The same match as an endpoint DNS rule that applies to Windows and macOS DNS telemetry.

title: DNS Lookup of an Account-Verification or Browser One-Time-Code Service
id: 0e1399c7-1224-4248-b93c-03deeedd0f48
status: experimental
description: >
  Detects lookups of services named in DPRK IT-worker operation material for
  bulk phone verification, disposable numbers and email, SSN validation, and
  browser-based TOTP generation that lets a team share one second factor.
references:
  - https://haydenmckenzie.com/research/dprk-it-worker-operation-part-two
  - https://haydenmckenzie.com/research/dprk-it-worker-cell-part-one
logsource:
  category: dns_query
detection:
  selection_otp_exact:
    QueryName: '2fa.live'
  selection_otp_sub:
    QueryName|endswith: '.2fa.live'
  # optional: the six pre-hire services are lower fidelity; delete this line and the two selections below it
  selection_prehire_exact:
    QueryName:
      - 'sms-man.com'
      - 'sms-activate.org'
      - 'mailforspam.com'
      - 'slynumber.com'
      - 'hushed.com'
      - 'ssn-check.org'
  selection_prehire_sub:
    QueryName|endswith:
      - '.sms-man.com'
      - '.sms-activate.org'
      - '.mailforspam.com'
      - '.slynumber.com'
      - '.hushed.com'
      - '.ssn-check.org'
  condition: 1 of selection_*
falsepositives:
  - Privacy-minded staff using a second number or a disposable address for
    personal sign-ups
level: medium

The same match over Falcon DnsRequest events on Windows and macOS.

#event_simpleName=DnsRequest
| lower(DomainName, as=DomainName)
| regex("(?<parent>[^.]+\\.[^.]+)\\.?$", field=DomainName)
| in(parent, values=[
    // optional: the six pre-hire services are lower fidelity; delete this line and the next
    "sms-man.com", "sms-activate.org", "mailforspam.com", "slynumber.com", "hushed.com", "ssn-check.org",
    "2fa.live"])
| groupBy([ComputerName], function=[count(as=Lookups), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen), count(parent, distinct=true, as=Services), collect([parent])])
| sort(Services, order=desc)

The same match over ECS DNS and network events, grouped by host.

FROM logs-*
| EVAL name = TO_LOWER(COALESCE(dns.question.name, destination.domain))
| WHERE name RLIKE "(.*\\.)?(2fa\\.live|sms-man\\.com|sms-activate\\.org|mailforspam\\.com|slynumber\\.com|hushed\\.com|ssn-check\\.org)\\.?"
| EVAL parent = REPLACE(name, "^(.*\\.)?([^.]+\\.[^.]+)\\.?$", "$2")
| STATS lookups = COUNT(*), services = COUNT_DISTINCT(parent), domains = VALUES(parent), first_seen = MIN(@timestamp), last_seen = MAX(@timestamp) BY host.name
| SORT services DESC, lookups DESC

The same match over Cortex network events carrying a DNS name.

dataset = xdr_data
| filter event_type = ENUM.NETWORK and (dns_query_name != null or action_external_hostname != null)
| alter host = lowercase(coalesce(dns_query_name, action_external_hostname))
| alter parent = arrayindex(regextract(host, "([^.]+[.][^.]+)[.]?$"), 0)
| filter parent in (
    // optional: the six pre-hire services are lower fidelity; delete this line and the next
    "sms-man.com", "sms-activate.org", "mailforspam.com", "slynumber.com", "hushed.com", "ssn-check.org",
    "2fa.live")
| comp count() as lookups, count_distinct(parent) as services, min(_time) as first_seen by agent_hostname
| sort desc services, desc lookups