Egress from ISPs and Proxy Services Reported in DPRK Worker Cases

Rows are users (sign-ins) or devices (lookups) that touched a reported address or name; these are ISP and proxy ranges with ordinary customers, so treat a hit as a lead.

// Hunt: egress from ISPs and proxy services reported in DPRK worker cases. ReliaQuest publishes 83.234.227.33-8 in compressed form; .33 to .38 is the reading used.
let ReportedAddresses = dynamic(["80.237.84.12", "80.237.87.21", "83.234.227.33", "83.234.227.34", "83.234.227.35", "83.234.227.36", "83.234.227.37", "83.234.227.38", "188.43.33.252", "188.43.136.41", "188.43.136.115", "188.43.253.77", "42.84.228.232", "60.20.1.234", "139.215.45.250", "113.227.237.46", "123.190.56.214"]);
union
( union SigninLogs, AADNonInteractiveUserSignInLogs
  | where TimeGenerated > ago(90d)
  | where IPAddress in (ReportedAddresses)
  | project Timestamp = TimeGenerated, Subject = UserPrincipalName, Signal = "reported-signin-address", Evidence = strcat(IPAddress, " ", AppDisplayName) ),
( DeviceNetworkEvents
  | where Timestamp > ago(90d)
  | where RemoteUrl has_any ("iproyal", "worktitans") or RemoteUrl contains "hangro.net.kp"
      // optional: any North Korean (.kp) name, not only the certificate subject ReliaQuest found
      or RemoteUrl endswith ".kp"
  | project Timestamp, Subject = DeviceName, Signal = "proxy-or-kp-name", Evidence = RemoteUrl )
| summarize Events = count(), Signals = make_set(Signal), Evidence = make_set(Evidence, 10), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by Subject
| sort by LastSeen desc

Sign-in addresses and name lookups across identity, DNS and proxy data per user or source address.

```Placeholders: index=identity holds Okta, Entra ID or ms:aad:signin events with src_ip and user extracted; index=dns or index=proxy hold name lookups and web requests.```
(index=identity (sourcetype=okta OR sourcetype=azuread OR sourcetype="ms:aad:signin") src_ip IN ("80.237.84.12", "80.237.87.21", "83.234.227.33", "83.234.227.34", "83.234.227.35", "83.234.227.36", "83.234.227.37", "83.234.227.38", "188.43.33.252", "188.43.136.41", "188.43.136.115", "188.43.253.77", "42.84.228.232", "60.20.1.234", "139.215.45.250", "113.227.237.46", "123.190.56.214"))
    OR ((index=dns OR index=proxy) ("iproyal" OR "worktitans" OR "hangro.net.kp"
        ```optional: any North Korean (.kp) name``` OR "*.kp"))
| eval signal=if(index="identity", "reported-signin-address", "proxy-or-kp-name"), subject=coalesce(user, src_ip)
| stats count AS events values(signal) AS signals values(src_ip) AS addresses min(_time) AS first_seen max(_time) AS last_seen BY subject
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen

Free-text address match over ingested sign-in events plus DnsRequest name matches from Falcon.

// Hunt: egress from ISPs and proxy services reported in DPRK worker cases. Scope the query to the repository holding your sign-in events; the address is matched as a whole token, so no parser field name is assumed.
regex("(?:^|[^0-9.])(?<matchedIp>80[.]237[.]84[.]12|80[.]237[.]87[.]21|83[.]234[.]227[.]33|83[.]234[.]227[.]34|83[.]234[.]227[.]35|83[.]234[.]227[.]36|83[.]234[.]227[.]37|83[.]234[.]227[.]38|188[.]43[.]33[.]252|188[.]43[.]136[.]41|188[.]43[.]136[.]115|188[.]43[.]253[.]77|42[.]84[.]228[.]232|60[.]20[.]1[.]234|139[.]215[.]45[.]250|113[.]227[.]237[.]46|123[.]190[.]56[.]214)(?:[^0-9.]|$)", strict=false)
| regex("(?:userPrincipalName|alternateId)[^a-zA-Z0-9_]+(?<user>[^\"]+)", strict=false)
| case {
    #event_simpleName=DnsRequest DomainName=/iproyal|worktitans|hangro[.]net[.]kp/i | signal := "proxy-or-kp-name";
    // optional: any North Korean (.kp) name
    #event_simpleName=DnsRequest DomainName=/[.]kp$/i | signal := "proxy-or-kp-name";
    matchedIp=* | signal := "reported-signin-address";
    * | signal := "";
  }
| signal != ""
| groupBy([signal, matchedIp, user, ComputerName], function=[count(as=events), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])
| sort(lastSeen, order=desc)

Sign-ins from the reported addresses and DNS lookups of the named services, per subject.

FROM logs-azure.signinlogs-*, logs-okta*, logs-endpoint.events.network-*
| WHERE @timestamp > NOW() - 90 days
| EVAL src = TO_STRING(source.ip)
| EVAL name = TO_LOWER(COALESCE(dns.question.name, ""))
| EVAL signal = CASE(
    src IN ("80.237.84.12", "80.237.87.21", "83.234.227.33", "83.234.227.34", "83.234.227.35", "83.234.227.36", "83.234.227.37", "83.234.227.38", "188.43.33.252", "188.43.136.41", "188.43.136.115", "188.43.253.77", "42.84.228.232", "60.20.1.234", "139.215.45.250", "113.227.237.46", "123.190.56.214"), "reported-signin-address",
    name RLIKE ".*(iproyal|worktitans|hangro[.]net[.]kp).*", "proxy-or-kp-name",
    "")
| EVAL signal = CASE(signal != "", signal, name RLIKE ".*[.]kp", "proxy-or-kp-name", "")
| WHERE signal != ""
| EVAL subject = COALESCE(azure.signinlogs.properties.user_principal_name, user.name, host.name)
| STATS events = COUNT(*), signals = VALUES(signal), first_seen = MIN(@timestamp), last_seen = MAX(@timestamp) BY subject
| SORT last_seen DESC

Endpoint lookups of the named proxy services and .kp names per host.

// Hunt: proxy-service and .kp names from endpoints. Sign-in addresses need your identity data, which xdr_data does not hold.
dataset = xdr_data
| filter event_type = ENUM.NETWORK and (dns_query_name ~= "(?i)iproyal|worktitans|hangro[.]net[.]kp"
        or action_external_hostname ~= "(?i)iproyal|worktitans|hangro[.]net[.]kp"
        // optional: any North Korean (.kp) name
        or dns_query_name ~= "(?i)[.]kp$")
| comp count() as events, values(dns_query_name) as names, min(_time) as first_seen, max(_time) as last_seen by agent_hostname
| sort desc last_seen