Fabricated Candidate Personas and Portfolio-Site Infrastructure

Recruiting workstations that reached the published persona site or another free portfolio site, persona hits first.

// Replace the placeholder with the recruiting workstations.
let RecruitingDevices = dynamic(["recruiting-ws-01"]);
DeviceNetworkEvents
| where Timestamp > ago(90d)
| where DeviceName in~ (RecruitingDevices)
| where RemoteUrl has "daniel-ayala.netlify.app"
     // optional: any free portfolio site on the two builders ReliaQuest names, which every such candidate matches
     or RemoteUrl has_any ("jimdosite.com", "netlify.app")
| extend Site = tolower(extract(@"(?i)(?:^|[./@])([a-z0-9-]+\.(?:jimdosite\.com|netlify\.app))(?:[:/?#]|$)", 1, RemoteUrl))
| summarize Requests = count(), Sites = make_set(Site, 20),
            PublishedPersona = countif(Site == "daniel-ayala.netlify.app"), LastSeen = max(Timestamp)
        by DeviceName, InitiatingProcessAccountName
| sort by PublishedPersona desc, LastSeen desc

Recruiting workstations and users that reached the published persona site or another free portfolio site, in proxy or DNS data.

```sourcetype placeholders: index=proxy (url, src, user) and index=dns (query, src); recruiting_workstations.csv has a src column```
```optional: the OR isnotnull(site) match covers any free portfolio site on the two builders ReliaQuest names, which every such candidate matches```
(index=proxy OR index=dns) (url=* OR query=*) earliest=-90d
| lookup recruiting_workstations.csv src OUTPUT team
| where isnotnull(team)
| eval target=lower(coalesce(url, query))
| rex field=target "(?:^|[./@])(?<site>[a-z0-9-]+\.(?:jimdosite\.com|netlify\.app))(?:[:/?#]|$)"
| eval published=if(site="daniel-ayala.netlify.app", 1, 0)
| where published=1 OR isnotnull(site)
| stats count AS requests values(site) AS sites sum(published) AS published_persona max(_time) AS last_seen BY src, user
| sort 0 - published_persona, - last_seen
| convert ctime(last_seen)

A lookup of the published persona site or of a free portfolio site, to be scoped to recruiting workstations in the SIEM.

title: Recruiting Workstation Lookup of a Fabricated Candidate Portfolio Site
id: b6d3e815-0f7a-4c92-91e4-3a5c8d2f7e10
status: experimental
description: >
  Detects a lookup of daniel-ayala.netlify.app, the persona site Mandiant
  published as a DPRK IT-worker indicator, or of any subdomain of the free
  site builders ReliaQuest names as hosting fabricated candidate profiles,
  jimdosite.com and netlify.app. Scope the rule to recruiting workstations,
  because these platforms host millions of legitimate sites.
references:
  - https://reliaquest.com/blog/threat-spotlight-identifying-north-korean-insider-threats
  - https://cloud.google.com/blog/topics/threat-intelligence/mitigating-dprk-it-worker-threat
logsource:
  category: dns_query
detection:
  selection_persona:
    QueryName: 'daniel-ayala.netlify.app'
  # optional: any free portfolio site on the two builders ReliaQuest names, which every such candidate matches
  selection_builders:
    QueryName|endswith:
      - '.jimdosite.com'
      - '.netlify.app'
  condition: 1 of selection_*
falsepositives:
  - Candidates who host an ordinary portfolio on either platform and are reviewed by recruiters
level: low

Recruiting workstations and users that reached the published persona site or another free portfolio site.

FROM logs-*
| WHERE @timestamp > NOW() - 90 days AND host.name IN ("recruiting-ws-01")
| EVAL target = TO_LOWER(COALESCE(url.original, dns.question.name, destination.domain))
| WHERE target IS NOT NULL
| GROK target "(?:^|[./@])(?<site>[a-z0-9-]+\\.(?:jimdosite\\.com|netlify\\.app))(?:[:/?#]|$)"
| WHERE site IS NOT NULL
| EVAL published = CASE(site == "daniel-ayala.netlify.app", 1, 0)
| STATS requests = COUNT(*), sites = VALUES(site), published_persona = SUM(published), last_seen = MAX(@timestamp) BY host.name, user.name
| SORT published_persona DESC, last_seen DESC
| LIMIT 200

Recruiting workstations that looked up the published persona site or another free portfolio site, persona hits first.

// Replace the placeholder with the recruiting workstations.
#event_simpleName=DnsRequest
| in(field=ComputerName, values=["recruiting-ws-01"], ignoreCase=true)
| DomainName=/^daniel-ayala\.netlify\.app$/i
    // optional: any free portfolio site on the two builders ReliaQuest names, which every such candidate matches
    or DomainName=/\.(jimdosite\.com|netlify\.app)$/i
| lower(field=DomainName, as=site)
| case { site="daniel-ayala.netlify.app" | published := 1; * | published := 0 }
| groupBy([aid, ComputerName], function=[count(as=requests), collect(site), sum(published, as=published_persona), max(@timestamp, as=last_seen)])
| sort(published_persona, order=desc)

Recruiting workstations and users that looked up the published persona site or another free portfolio site, persona hits first.

// Replace the placeholder with the recruiting workstations.
dataset = xdr_data
| filter event_type = ENUM.NETWORK and dns_query_name != null and agent_hostname in ("recruiting-ws-01")
| alter site = lowercase(dns_query_name)
| filter site = "daniel-ayala.netlify.app"
    // optional: any free portfolio site on the two builders ReliaQuest names, which every such candidate matches
    or site ~= "\.(jimdosite\.com|netlify\.app)$"
| alter published = if(site = "daniel-ayala.netlify.app", 1, 0)
| comp count() as requests, values(site) as sites, sum(published) as published_persona, max(_time) as last_seen by agent_hostname, actor_effective_username
| sort desc published_persona