Impersonation Domains Acquired to Support Voice Phishing Helpdesk Social Engineering

// THREAT-Infra-VishingHelpdeskDomains (T1583.001) - Impersonation domains for helpdesk/SSO vishing social engineering
// Pillar 1: DNS queries to domains combining org brand + helpdesk/SSO/MFA keywords
let OrgBrand = "victimcorp"; // CUSTOMIZE: replace with your organization's brand token(s)
let HelpdeskKeywords = dynamic([
  "helpdesk", "help-desk", "servicedesk", "service-desk", "itsupport", "it-support",
  "sso", "okta", "duo", "mfa", "authenticator", "verify", "identity", "reset-password", "password-reset"
]);
DnsEvents
| where TimeGenerated > ago(24h)
| where ResultCode == 0
| where Name has OrgBrand and Name has_any (HelpdeskKeywords)
| extend SuspicionReason = "BrandPlusHelpdeskKeywordDomain"
| project TimeGenerated, Computer, ClientIP, QueryName=Name, ResolvedIPs=IPAddresses, SuspicionReason
| union (
    // Pillar 2: First-ever resolution in the environment for a domain matching the brand+keyword pattern (no history in prior 30 days)
    DnsEvents
    | where TimeGenerated > ago(24h)
    | where Name has OrgBrand and Name has_any (HelpdeskKeywords)
    | join kind=leftanti (
        DnsEvents
        | where TimeGenerated between (ago(30d) .. ago(24h))
        | distinct Name
      ) on Name
    | extend SuspicionReason = "FirstEverResolutionOfBrandLookalike", ClientIP = ClientIP, ResolvedIPs = IPAddresses
    | project TimeGenerated, Computer, ClientIP, QueryName=Name, ResolvedIPs, SuspicionReason
)
| sort by TimeGenerated desc

| union
[
  search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
  | eval OrgBrand="victimcorp"
  | eval QueryLower=lower(QueryName)
  | where like(QueryLower, "%".OrgBrand."%")
  | where match(QueryLower, "(helpdesk|help-desk|servicedesk|service-desk|itsupport|it-support|sso|okta|duo|mfa|authenticator|verify|identity|reset-password|password-reset)")
  | eval SuspicionReason="BrandPlusHelpdeskKeywordDomain"
  | table _time, host, User, QueryName, QueryResults, SuspicionReason
]
[
  | tstats count where index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 by QueryName, _time span=1d
  | eval OrgBrand="victimcorp"
  | eval QueryLower=lower(QueryName)
  | where like(QueryLower, "%".OrgBrand."%")
  | where match(QueryLower, "(helpdesk|sso|okta|duo|mfa|verify|identity|reset-password)")
  | stats min(_time) as FirstSeen by QueryName
  | where FirstSeen >= relative_time(now(), "-1d@d")
  | eval SuspicionReason="FirstEverResolutionOfBrandLookalike"
  | table FirstSeen, QueryName, SuspicionReason
]
| sort - _time

sequence by client.ip with maxspan=5m
[
  dns where event.type == "connection" and
    dns.question.name : ("*victimcorp*helpdesk*", "*victimcorp*sso*", "*victimcorp*mfa*", "*victimcorp*verify*")
]
[
  network where network.protocol == "http" and
    http.request.method == "POST"
]

SELECT
  DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip, "QueryName",
  CASE
    WHEN "QueryName" ILIKE '%victimcorp%helpdesk%' OR "QueryName" ILIKE '%victimcorp%sso%' OR "QueryName" ILIKE '%victimcorp%mfa%' THEN 80
    ELSE 50
  END AS RiskScore
FROM events
WHERE
  "QueryName" ILIKE '%victimcorp%'
  AND ("QueryName" ILIKE '%helpdesk%' OR "QueryName" ILIKE '%sso%' OR "QueryName" ILIKE '%mfa%'
       OR "QueryName" ILIKE '%verify%' OR "QueryName" ILIKE '%identity%' OR "QueryName" ILIKE '%reset%')
  AND LOGSOURCETYPENAME(devicetype) ILIKE '%dns%'
ORDER BY RiskScore DESC
LAST 24 HOURS

_sourceCategory=*dns*
| json auto
| where QueryName matches "*victimcorp*"
| where matches(QueryName, "helpdesk|sso|okta|duo|mfa|verify|identity|reset")
| eval RiskScore = if(matches(QueryName, "helpdesk|sso|mfa"), 80, 50)
| stats count as QueryCount, values(QueryName) as SampleDomains by _sourceHost, RiskScore
| sort by RiskScore desc

rule vishing_helpdesk_impersonation_domain {
  meta:
    author = "Detection Engineering"
    description = "Detects DNS resolution of domains combining organization brand token with helpdesk/SSO/MFA keywords, indicative of vishing impersonation infrastructure"
    severity = "HIGH"
    confidence = "medium"
    mitre_attack = "T1583.001"
    reference = "https://attack.mitre.org/techniques/T1583/001/"

  events:
    $e.metadata.event_type = "NETWORK_DNS"
    re.regex($e.network.dns.questions.name, `(?i)victimcorp.*(helpdesk|sso|okta|duo|mfa|verify|identity|reset)`)

  condition:
    $e
}

#event_simpleName=DnsRequest
| DomainName=/(?i)victimcorp.*(helpdesk|sso|okta|duo|mfa|verify|identity|reset)/
| groupBy([aid, ComputerName, DomainName], function=[count(as=QueryCount), min(timestamp, as=FirstSeen)])
| case {
    DomainName=/(?i)(helpdesk|sso|mfa)/ => RiskScore := "High";
    * => RiskScore := "Medium";
  }
| table([ComputerName, DomainName, QueryCount, RiskScore, FirstSeen])
| sort(RiskScore)