2050?N5??13???́g?s?R?ȗ\??h?ɗv???Ӂ@M365?J?????_?[?????p????V?}???E?F?A?F?Z?L?????e?B?j???[?X?A???[?g

?@????m?F???ꂽ?}???E?F?A?uHOLLOWGRAPH?v?́A?N?Q???ꂽMicrosoft 365?A?J?E???g?????Microsoft Graph API?????p???A?U???҂Ƃ̃R?}???h???R???g???[???iC2?j?ʐM??Microsoft 365?̒ʏ?̒ʐM?ɕ??ꍞ?܂???B?ϑ????ꂽ??񂩂?A?U???Ώۂ̓C?X???G???֘A?g?D?ɏd?_???u????Ă????B

?@HOLLOWGRAPH??.NET NativeAOT?ŃR???p?C?????ꂽDLL?ŁA?uget?v?Ɓusend?v??2?‚̃R?}???h???????B?N?Q???ꂽMicrosoft 365???[???{?b?N?X?̃J?????_?[???A?U???҂Ƃ̑o?????̏??󂯓n???ꏊ?i?f?b?h?h???b?v?j?Ƃ??ė??p????B?uget?v?ŃJ?????_?[?̗\??ɓY?t???ꂽ?w?߂??擾???A?usend?v?Őގ悵???t?@?C?????Í??????ė\??ɓY?t????B?C?x???g?̓??t?͂??????2050?N5??13???ɐݒ肳??A???L?҂̖ڂɂ‚??ɂ???????d?g?݂ƂȂ??Ă???B

?@C2?ʐM?ɂ͎??Microsoft Graph API?𗘗p???A?F?؏??̍X?V?ɂ͕ʌo?H?Ƃ???DNS?g???l?????O???g???B????M?????f?[?^??RSA??AES-256-GCM??g?ݍ??킹???n?C?u???b?h?Í??ŕی삳??A?R?}???h??M?p?Ə?񑗐M?p?ňقȂ?RSA???y?A???g?????ƂŁA???ꂼ???Ɨ????ĕی삷??B

?@Microsoft Graph API?𗘗p???邽?߂́uMicrosoft Entra ID?v?̔F?؏??͕ʌo?H?ōX?V?????BHOLLOWGRAPH?͍U???ҊǗ????̃h???C???ucloudlanecdn[.]com?v?ɑ΂?IPv6??AAAA???R?[?h???g????DNS?₢???킹?????{???ADNS?g???l?????O?ɂ????tenant ID?Aclient ID?Aclient secret?A???[???{?b?N?X?????X?V????B?擾???????̓??[?J???t?@?C???ulogAzure.txt?v?ɕۑ?????A?Ȍ?̔F?؂ɗ??p?????B

?@?}???E?F?A?ɂ?tenant ID??client ID?Aclient secret?A?Ώۃ??[???{?b?N?X?AC2?h???C???ARSA???Ȃǂ??܂ސݒ??񂪖??ߍ??܂?Ă???A???s???ɁulogAzure.txt?v?Ƃ??ăf?B?X?N?ɏ????o?????BDNS?o?R?ōX?V???ꂽ?F?؏??????t?@?C???֔??f?????B

?@Group-IB?́AHOLLOWGRAPH??Cavern?t???[?????[?N?Ɗ֘A?t???鍪???Ƃ??āA?R?}???h?`????C2?T?[?o?Ƃ̒ʐM?\???̈?v?????????BGroup-IB?ɂ??ƁA?U???҂??瑗?M???ꂽ?uMzU=?v?Ƃ????l?𕜍?????Ɓu003?v?ɂȂ?ACavern?Ńf?o?b?O???O?̐؂?ւ??Ɏg????R?}???h?ƈ?v?????Ƃ??Ă???B?ϑ?????C2?ʐM?̃^?X?N?`????Cavern?̎d?l?ƈ?v?????Ƃ????B

?U???̔w?i?Ƌ??ЃA?N?^?[?̉e

?@?????󋵂ɂ‚??ẮA?N?Q???ꂽMicrosoft 365???[???{?b?N?X???C?X???G???̑g?D?ɑ????Ă??????Ƃɉ????AHOLLOWGRAPH??Cavern?֘A?t?@?C?????C?X???G??????A?b?v???[?h????Ă??????ƂȂǂ???A?U???̓C?X???G???֘A?g?D??_?????W?I?^?ł???ƕ]???????B?ł??Â??ʐM??2026?N6??3???A?ŐV?͓??N7??9???Ɋm?F????Ă???A???Ȃ??Ƃ?6?????{????^?p????Ă????Ƃ????B?m?F???ꂽ??????12???????????A?ϑ????Ԓ??Ɏ??ۂɍU???҂ƒʐM???Ă????͖̂?3???ɂƂǂ܂?A?U???҂??Ώۂ????肵?ĉ^?p???Ă????”\?????????ꂽ?B

?@?U???҂̋A???ɂ‚??āAGroup-IB?͌????_?Ŋ??m?̋??ЃA?N?^?[?֍????m?x?Ō??ѕt???邱?Ƃ͂ł??Ȃ??Ƃ??Ă???B?????ŃC?????Ƃ̊֘A???w?E????鋺?ЃA?N?^?[?uLyceum?v?ƋZ?p?I?ȗގ??_???m?F?????Ɛ????????B???????A?????̓????͋A???𗠕t????ɂ͏\???ȓƎ??????Ȃ??ALyceum?Ƃ̊֘A???ɂ‚??Ă͒Ⴂ?m?x?̕]???ɂƂǂ߂Ă???B

?@Group-IB?́AMicrosoft Graph API??Microsoft 365?č????O?ɂ?????ُ?ȃJ?????_?[????̊Ď??A2050?N5??13???ɐݒ肳?ꂽ?C?x???g??uEvent ID: <taskID>?v?uBoss{..}ID{..}?v?Ƃ??????????A?uFile{n}.txt?v?Y?t?t?@?C???̌??o?AOAuth2?A?v???P?[?V??????Microsoft Entra ID?F?؏??̊Ď??ADNS?g???l?????O?????m???邽?߂?AAAA???R?[?h?Ď??Ȃǂ𐄏????Ă???B