APT 35 - Charming Kitten - G0059 — Magic Hound | Inbound Password-Protected Archive Delivery from Freemail/Lookalike Senders
Detects inbound emails containing password-protected archives (rar, zip, 7z) from either common freemail providers or domains matching known social engineering themes (e.g., webinar, interview, research). The rule specifically flags emails where the subject or body includes password hints (e.g., 'pwd', 'extract', 'unzip') indicating an attempt to deliver malicious payloads while evading email gateway inspection.
Microsoft Sentinel (KQL)
