← Back to SOC feed Coverage →

Threat actor Phosphorus masquerading as conference organizers

kql MEDIUM Azure-Sentinel
EmailEvents
backdoorhuntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-06T11:00:00Z · Confidence: medium

Hunt Hypothesis

Threat actor Phosphorus may be using compromised email accounts to impersonate conference organizers and distribute malicious attachments or links. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate potential credential theft and phishing campaigns associated with this advanced persistent threat.

KQL Query

//All emails from the threat actor Phosphorus, masquerading as conference organizers, based on the IOCs shared 
// by Microsoft's Threat Intelligence Center in: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
let MaliciousSenders = dynamic(["t20saudiarabia@outlook.sa", "t20saudiarabia@hotmail.com", "t20saudiarabia@gmail.com", "munichconference@outlook.com",  
"munichconference@outlook.de", "munichconference1962@gmail.com"]);
EmailEvents
| where SenderFromAddress  in~ (MaliciousSenders)

Analytic Rule Definition

id: 95510f90-597c-407e-bbe6-0e0319b456b0
name: Threat actor Phosphorus masquerading as conference organizers
description: |
  Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC.
  Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
- Initial access
query: |
  //All emails from the threat actor Phosphorus, masquerading as conference organizers, based on the IOCs shared 
  // by Microsoft's Threat Intelligence Center in: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
  let MaliciousSenders = dynamic(["t20saudiarabia@outlook.sa", "t20saudiarabia@hotmail.com", "t20saudiarabia@gmail.com", "munichconference@outlook.com",  
  "munichconference@outlook.de", "munichconference1962@gmail.com"]);
  EmailEvents
  | where SenderFromAddress  in~ (MaliciousSenders)

Required Data Sources

Sentinel TableNotes
EmailEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Campaigns/Threat actor Phosphorus masquerading as conference organizers.yaml