# =============================================================================
# SIGMA RULE PACK: Handala / Void Manticore / Iranian MOIS Threat Actor
# TTPs: Intune MDM Wiper, Entra ID Admin Compromise, Starlink C2 (AS14593)
# Reference: Stryker Corporation wiper attack - March 11, 2026
# Author: ThreatHunter.ai
# License: Detection Rules License 1.1 (DRL 1.1)
# MITRE ATT&CK: T1072, T1485, T1491, T1561, T1078, T1566, T1005
# =============================================================================


# -----------------------------------------------------------------------------
# RULE 1: Mass Remote Wipe Issued via Microsoft Intune
# MITRE: T1485 (Data Destruction), T1072 (Software Deployment Tools)
# Critical - This is the primary destructive payload mechanism
# -----------------------------------------------------------------------------
title: Mass Device Wipe Command via Microsoft Intune Admin Console
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: stable
description: >
    Detects bulk remote wipe commands issued through the Microsoft Intune admin
    console. Handala weaponized Intune's legitimate wipe function to destroy
    data across 200,000+ endpoints in the Stryker attack. A single wipe is
    potentially legitimate. Five or more in a short window is an incident.
author: ThreatHunter.ai
date: 2026/03/12
references:
    - https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/
    - https://www.bleepingcomputer.com/news/security/medtech-giant-stryker-offline-after-iran-linked-wiper-malware-attack/
tags:
    - attack.impact
    - attack.t1485
    - attack.t1072
    - attack.t1561
logsource:
    product: microsoft
    service: intune_audit
    # Maps to: Microsoft Endpoint Manager / Intune Audit Logs
    # Log source in Sentinel: IntuneAuditLogs
    # Log source in Splunk: ms:o365:management with workload=MicrosoftIntune
detection:
    selection_wipe_actions:
        OperationName|contains:
            - 'remotewipe'
            - 'Wipe'
            - 'retireAndWipe'
            - 'retire'
            - 'deleteDevice'
            - 'RemoteWipeDevice'
    selection_bulk_indicator:
        # Trigger if same actor issues 5+ wipe commands within detection window
        # Implement as aggregation - see condition below
        Actor.UPN|exists: true
    filter_legitimate_helpdesk:
        # Optionally filter known MDM admin service accounts
        # Populate this with your actual helpdesk/MDM admin UPNs
        Actor.UPN|contains:
            - 'intune-svc@'
            - 'mdm-admin@'
    condition: selection_wipe_actions and selection_bulk_indicator and not filter_legitimate_helpdesk | count(TargetObjectName) by Actor.UPN > 5
    timeframe: 15m
falsepositives:
    - Legitimate mass device retirement during MDM migrations
    - Decommissioning events - correlate with change management tickets
level: critical
fields:
    - Actor.UPN
    - TargetObjectName
    - OperationName
    - ActivityDateTime
    - ResultStatus
    - ClientAppUsed


# -----------------------------------------------------------------------------
# RULE 2: Entra ID Global Admin Login from Starlink ASN (AS14593)
# MITRE: T1078 (Valid Accounts), T1078.004 (Cloud Accounts)
# High - Privileged cloud admin auth from satellite ISP is anomalous
# -----------------------------------------------------------------------------
title: Privileged Entra ID Authentication Originating from Starlink Infrastructure
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: stable
description: >
    Detects Global Administrator, Intune Administrator, or other privileged
    role authentication to Entra ID (Azure AD) from IP space belonging to
    SpaceX Starlink (AS14593). Handala operators used smuggled Starlink terminals
    inside Iran during domestic internet blackouts to maintain C2 connectivity.
    Starlink IPs will NOT geolocate to Iran - they will appear as US-based.
    Detection must be ASN-based, not geography-based.
author: ThreatHunter.ai
date: 2026/03/12
references:
    - https://blog.checkpoint.com/research/what-defenders-need-to-know-about-irans-cyber-capabilities/
tags:
    - attack.initial_access
    - attack.t1078
    - attack.t1078.004
    - attack.persistence
logsource:
    product: azure
    service: signinlogs
    # Microsoft Sentinel: SigninLogs table
    # Splunk: azure:monitor:aad
detection:
    selection_privileged_roles:
        RoleName|contains:
            - 'Global Administrator'
            - 'Intune Administrator'
            - 'Cloud Device Administrator'
            - 'Privileged Role Administrator'
            - 'Security Administrator'
            - 'Exchange Administrator'
            - 'Application Administrator'
            - 'Authentication Administrator'
    selection_starlink_asn:
        # Primary Starlink ASN - this is the critical field
        # In Sentinel: NetworkLocationDetails or IPAddress enrichment
        # In raw logs: check AutonomousSystemNumber field
        AutonomousSystemNumber: 14593
        # Also catch by ASN name in case enrichment renders it differently
        # NetworkLocationDetails|contains: 'SpaceX'
    filter_known_remote_workers:
        # Optional: allowlist known legitimate remote/field workers on Starlink
        UserPrincipalName|contains:
            - 'field-'   # customize to your environment
    condition: selection_privileged_roles and selection_starlink_asn and not filter_known_remote_workers
falsepositives:
    - Remote IT admins in rural areas using Starlink as primary ISP
    - Field engineers with Starlink on vessels or remote sites
    - Validate against known user baseline before escalating
level: high
fields:
    - UserPrincipalName
    - IPAddress
    - AutonomousSystemNumber
    - RoleName
    - AppDisplayName
    - ResultType
    - ResultDescription
    - Location
    - DeviceDetail.operatingSystem
    - AuthenticationRequirement


# -----------------------------------------------------------------------------
# RULE 3: Entra ID Admin Authentication from Iranian ASN Space
# MITRE: T1078.004 (Cloud Accounts)
# High - Direct Iranian IP space hitting cloud admin planes
# -----------------------------------------------------------------------------
title: Entra ID Privileged Authentication from Iranian Autonomous System Numbers
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: stable
description: >
    Detects privileged Entra ID authentication from IP ranges belonging to
    Iranian autonomous systems. This covers the traditional Iranian IP vector
    that Handala uses alongside Starlink. These ASNs are allocated to Iranian
    ISPs and state infrastructure. Note: Starlink-based Iranian operators will
    NOT appear here - use Rule 2 in conjunction.
author: ThreatHunter.ai
date: 2026/03/12
tags:
    - attack.initial_access
    - attack.t1078
    - attack.t1078.004
logsource:
    product: azure
    service: signinlogs
detection:
    selection_privileged_roles:
        RoleName|contains:
            - 'Global Administrator'
            - 'Intune Administrator'
            - 'Cloud Device Administrator'
            - 'Privileged Role Administrator'
            - 'Security Administrator'
    selection_iranian_asns:
        # Major Iranian ASNs - update as BGP allocations change
        # Source: RIPE NCC / ARIN allocations to Iranian entities
        AutonomousSystemNumber|contains:
            - '12880'   # Information Technology Company (ITC) - Iran's gateway
            - '48159'   # Telecommunications Infrastructure Company of Iran
            - '44244'   # Iran Cell Service and Communication Company
            - '197207'  # Mobile Communication Company of Iran
            - '43754'   # Asiatech Data Transfer
            - '25124'   # Data Rasaneh Avabarid
            - '42337'   # Respina Networks
            - '31549'   # Aria Shatel Company
            - '39650'   # Pars Online
            - '48434'   # Noyan Abr Arvan (Arvan Cloud)
            - '58224'   # Iran Telecommunication Company
            - '24631'   # Fanava Group
            - '21341'   # Cooperative Telecommunications of Iran
            - '50810'   # Mobinnet
            - '44285'   # Rayaneh Oshia
    condition: selection_privileged_roles and selection_iranian_asns
falsepositives:
    - Iranian diaspora employees using VPN that exits in Iran (unlikely for admin roles)
    - Misconfigured VPN split tunneling
level: high
fields:
    - UserPrincipalName
    - IPAddress
    - AutonomousSystemNumber
    - RoleName
    - Location
    - ResultType


# -----------------------------------------------------------------------------
# RULE 4: Intune Admin Console Access Outside Business Hours
# MITRE: T1072 (Software Deployment Tools), T1078 (Valid Accounts)
# Medium/High - Handala executed the wipe just after midnight EDT
# -----------------------------------------------------------------------------
title: Microsoft Intune Administrative Console Access During Off-Hours
id: d4e5f6a7-b8c9-0123-defa-234567890123
status: stable
description: >
    Detects access to the Microsoft Intune administrative console outside of
    defined business hours. The Stryker wipe was executed just after midnight
    EDT on March 11, 2026. Off-hours Intune admin access is a high-fidelity
    indicator of either compromised credentials or insider threat, particularly
    when combined with Starlink or foreign ASN source IPs.
    Tune the hour window to match your organization's business hours.
author: ThreatHunter.ai
date: 2026/03/12
tags:
    - attack.execution
    - attack.t1072
    - attack.t1078
logsource:
    product: microsoft
    service: intune_audit
detection:
    selection_admin_operations:
        OperationName|contains:
            - 'remotewipe'
            - 'Wipe'
            - 'deleteDevice'
            - 'CreateDeviceCompliancePolicy'
            - 'UpdateDeviceCompliancePolicy'
            - 'CreateDeviceConfiguration'
            - 'CreatePolicySet'
            - 'assignDeviceCategory'
        ResultStatus: 'Success'
    filter_business_hours:
        # UTC hours - adjust to your org timezone
        # This excludes 06:00-18:00 UTC (roughly 1am-1pm EDT)
        # Events OUTSIDE this window will fire the rule
        ActivityDateTime|re: '^.*(T00:|T01:|T02:|T03:|T04:|T05:|T18:|T19:|T20:|T21:|T22:|T23:).*'
    condition: selection_admin_operations and filter_business_hours
falsepositives:
    - Scheduled automation tasks running outside hours
    - On-call IT admins responding to incidents
    - Global orgs with legitimate after-hours admins in other timezones
    - Correlate with change management before escalating
level: medium
fields:
    - Actor.UPN
    - OperationName
    - ActivityDateTime
    - TargetObjectName
    - ResultStatus
    - ClientAppUsed


# -----------------------------------------------------------------------------
# RULE 5: Entra Login Page Defacement - Handala Logo Branding
# MITRE: T1491.001 (Defacement: Internal Defacement)
# High - Direct IOC from the Stryker attack
# -----------------------------------------------------------------------------
title: Entra ID / Azure AD Login Page Defacement Indicators
id: e5f6a7b8-c9d0-1234-efab-345678901234
status: experimental
description: >
    Detects changes to Entra ID (Azure AD) company branding or login page
    customization that may indicate defacement by a threat actor. In the Stryker
    attack, Handala replaced login screens with their logo across all affected
    tenants. This rule monitors the Entra ID audit log for branding modifications
    made outside of normal change windows, particularly from anomalous source IPs.
author: ThreatHunter.ai
date: 2026/03/12
references:
    - https://www.govinfosecurity.com/medtech-firm-stryker-disrupted-by-pro-iran-hackers-a-30980
tags:
    - attack.impact
    - attack.t1491
    - attack.t1491.001
logsource:
    product: azure
    service: auditlogs
    # Microsoft Sentinel: AuditLogs table
    # Category: CompanyBranding or DirectoryManagement
detection:
    selection_branding_changes:
        OperationName|contains:
            - 'Set Company Branding'
            - 'Update Company Branding'
            - 'Set LoginPageLayout'
            - 'Update OrganizationalBranding'
    selection_anomalous_source:
        # Flag if change comes from non-standard admin locations
        # Combine with ASN checks from Rules 2 and 3
        ResultType: '0'   # Success
    condition: selection_branding_changes and selection_anomalous_source
falsepositives:
    - Legitimate rebranding by corporate marketing
    - IT admin updating login page during maintenance
    - Always correlate with change ticket
level: high
fields:
    - InitiatedBy.user.userPrincipalName
    - InitiatedBy.user.ipAddress
    - OperationName
    - TargetResources
    - ActivityDateTime


# -----------------------------------------------------------------------------
# RULE 6: Large Volume Outbound Data Transfer from Entra / M365 Tenant
# MITRE: T1005 (Data from Local System), T1567 (Exfiltration Over Web Service)
# High - Pre-wipe exfil. 50TB claimed in Stryker. Hunt for sustained high-volume transfers.
# -----------------------------------------------------------------------------
title: Anomalous High-Volume Data Download from Microsoft 365 / SharePoint / OneDrive
id: f6a7b8c9-d0e1-2345-fabc-456789012345
status: stable
description: >
    Detects abnormally large data downloads from Microsoft 365 services
    including SharePoint and OneDrive. Handala claimed 50TB exfiltrated from
    Stryker prior to executing the wipe. Pre-wipe exfiltration is the standard
    MOIS playbook - steal first, destroy second. Large sustained downloads
    from a single user or service account, especially from anomalous IPs or
    during off-hours, are a critical pre-incident indicator.
author: ThreatHunter.ai
date: 2026/03/12
tags:
    - attack.exfiltration
    - attack.t1005
    - attack.t1567
    - attack.t1030
logsource:
    product: microsoft
    service: o365
    definition: 'Requires Microsoft 365 Unified Audit Log or Defender for Cloud Apps'
detection:
    selection_download_events:
        Operation|contains:
            - 'FileDownloaded'
            - 'FileSyncDownloadedFull'
            - 'FileAccessed'
            - 'SearchExportDownloaded'
            - 'MailItemsAccessed'
    selection_volume_threshold:
        # This requires aggregation in your SIEM
        # Trigger on users exceeding threshold within window
        UserId|exists: true
    condition: selection_download_events | count() by UserId > 1000
    timeframe: 1h
falsepositives:
    - Data migration projects
    - Backup service accounts
    - Legal hold / eDiscovery exports - validate against legal team
level: high
fields:
    - UserId
    - Operation
    - ObjectId
    - ClientIP
    - UserAgent
    - ResultStatus
    - Site_Url


# -----------------------------------------------------------------------------
# RULE 7: Suspicious Entra ID Global Admin Role Assignment
# MITRE: T1078.004 (Cloud Accounts), T1098.003 (Account Manipulation)
# Critical - Attackers granting themselves persistence via role elevation
# -----------------------------------------------------------------------------
title: Unexpected Global Administrator Role Assignment in Entra ID
id: a7b8c9d0-e1f2-3456-abcd-567890123456
status: stable
description: >
    Detects assignment of Global Administrator or other high-privilege roles
    in Entra ID (Azure AD). Before executing the Intune wipe, attackers must
    have held or obtained Global Admin or Intune Admin rights. Role assignments
    made outside of normal hours, from anomalous IPs, or to unfamiliar accounts
    are a critical pre-compromise indicator. Especially alert on role grants
    to newly created or guest accounts.
author: ThreatHunter.ai
date: 2026/03/12
tags:
    - attack.persistence
    - attack.t1078.004
    - attack.t1098.003
    - attack.privilege_escalation
logsource:
    product: azure
    service: auditlogs
detection:
    selection_role_assignment:
        OperationName|contains:
            - 'Add member to role'
            - 'Add eligible member to role'
        TargetResources.modifiedProperties.newValue|contains:
            - 'Global Administrator'
            - 'Intune Administrator'
            - 'Cloud Device Administrator'
            - 'Privileged Role Administrator'
            - 'Security Administrator'
            - 'User Administrator'
            - 'Authentication Administrator'
    filter_expected_admins:
        # Populate with your known IT admin UPNs
        InitiatedBy.user.userPrincipalName|contains:
            - 'it-admin@'
            - 'svc-identity@'
    condition: selection_role_assignment and not filter_expected_admins
falsepositives:
    - Legitimate IT onboarding of new admins
    - PIM (Privileged Identity Management) activations - these will show differently
    - Always validate against HR ticketing system
level: critical
fields:
    - InitiatedBy.user.userPrincipalName
    - InitiatedBy.user.ipAddress
    - TargetResources.userPrincipalName
    - TargetResources.modifiedProperties.newValue
    - ActivityDateTime
    - CorrelationId


# -----------------------------------------------------------------------------
# RULE 8: Intune Device Compliance Policy Mass Modification
# MITRE: T1072 (Software Deployment Tools), T1562.001 (Impair Defenses)
# High - Pre-wipe step: disabling compliance gates that would block the wipe
# -----------------------------------------------------------------------------
title: Bulk Modification of Microsoft Intune Device Compliance Policies
id: b8c9d0e1-f2a3-4567-bcde-678901234567
status: stable
description: >
    Detects mass modification or deletion of device compliance policies in
    Microsoft Intune. Before issuing wipe commands, an attacker may need to
    modify compliance policies to ensure the wipe command propagates to all
    devices regardless of compliance state. Multiple policy changes in a short
    window outside of change management hours is a high-fidelity indicator.
author: ThreatHunter.ai
date: 2026/03/12
tags:
    - attack.execution
    - attack.t1072
    - attack.t1562
    - attack.t1562.001
logsource:
    product: microsoft
    service: intune_audit
detection:
    selection_policy_modification:
        OperationName|contains:
            - 'DeleteDeviceCompliancePolicy'
            - 'UpdateDeviceCompliancePolicy'
            - 'CreateDeviceCompliancePolicy'
            - 'DeleteDeviceConfiguration'
            - 'UpdateDeviceConfiguration'
            - 'DeleteConfigurationPolicy'
            - 'UpdateConfigurationPolicy'
        ResultStatus: 'Success'
    condition: selection_policy_modification | count() by Actor.UPN > 3
    timeframe: 10m
falsepositives:
    - Large-scale MDM migrations
    - Quarterly policy review cycles
    - Always correlate with change management records
level: high
fields:
    - Actor.UPN
    - OperationName
    - TargetObjectName
    - ActivityDateTime
    - ResultStatus


# -----------------------------------------------------------------------------
# RULE 9: Email Sent to Executives from External Unknown Sender Post-Attack
# MITRE: T1491 (Defacement), Influence / Psyop Component
# Medium - Handala sent emails to Stryker executives claiming ownership
# -----------------------------------------------------------------------------
title: Suspicious External Email to Executive Distribution List Claiming Cyber Attack
id: c9d0e1f2-a3b4-5678-cdef-789012345678
status: experimental
description: >
    Detects external emails sent to executive-level distribution lists or C-suite
    accounts containing subject lines or content consistent with attack claim
    messaging. In the Stryker attack, Handala sent emails to company executives
    taking ownership of the cyberattack as part of their psychological operations
    component. This rule targets the PSYOP delivery mechanism.
author: ThreatHunter.ai
date: 2026/03/12
tags:
    - attack.impact
    - attack.t1491
logsource:
    product: microsoft
    service: o365
    definition: 'Requires Microsoft Defender for Office 365 or Unified Audit Log'
detection:
    selection_executive_targets:
        RecipientDomain|contains: 'yourdomain.com'  # Replace with your domain
        RecipientEmailAddress|contains:
            - 'ceo@'
            - 'ciso@'
            - 'cto@'
            - 'coo@'
            - 'cfo@'
            - 'vp-'
            - 'svp-'
            - 'exec-'
            - 'board@'
    selection_suspicious_content:
        Subject|contains:
            - 'hacked'
            - 'breached'
            - 'wiped'
            - 'your data'
            - 'we own'
            - 'Handala'
            - 'retaliation'
            - 'operation'
            - 'all your systems'
            - 'terabytes'
    selection_external_sender:
        SenderFromDomain|not|contains: 'yourdomain.com'  # Replace with your domain
    condition: selection_executive_targets and selection_suspicious_content and selection_external_sender
falsepositives:
    - Security awareness training phishing simulations
    - Vendor breach notification emails
    - Always review manually before escalating
level: medium
fields:
    - SenderFromAddress
    - SenderFromDomain
    - RecipientEmailAddress
    - Subject
    - DeliveryAction
    - ThreatTypes


# -----------------------------------------------------------------------------
# RULE 10: Starlink ASN Activity Against Cloud Admin Portals - Correlated
# MITRE: T1078.004, T1072, T1485
# Critical - Composite detection combining Rules 2 + 4 + 1 into single alert
# -----------------------------------------------------------------------------
title: Starlink-Sourced Authentication to Cloud Management Plane - Composite
id: d0e1f2a3-b4c5-6789-defa-890123456789
status: stable
description: >
    Composite rule detecting Starlink ASN (AS14593) authentication to any
    Microsoft cloud management plane - Intune, Entra ID, Azure Portal, or
    Microsoft 365 Admin Center. This is the highest-fidelity single-rule
    detection for the Handala attack pattern. Starlink should never be
    a normal access path for cloud admin portals in a standard enterprise.
    Any hit warrants immediate investigation.
author: ThreatHunter.ai
date: 2026/03/12
tags:
    - attack.initial_access
    - attack.t1078.004
    - attack.execution
    - attack.t1072
    - attack.impact
    - attack.t1485
logsource:
    product: azure
    service: signinlogs
detection:
    selection_starlink:
        AutonomousSystemNumber: 14593
    selection_admin_apps:
        AppDisplayName|contains:
            - 'Microsoft Intune'
            - 'Microsoft Intune Enrollment'
            - 'Azure Portal'
            - 'Microsoft 365 admin center'
            - 'Microsoft Azure Management'
            - 'Azure Active Directory'
            - 'Microsoft Endpoint Manager'
            - 'Entra admin center'
    selection_success:
        ResultType: '0'  # Successful authentication only
    condition: selection_starlink and selection_admin_apps and selection_success
falsepositives:
    - IT administrators in rural/remote locations with Starlink as primary ISP
    - Validate against list of known Starlink users in your org
    - Zero expected false positives in most enterprise environments
level: critical
fields:
    - UserPrincipalName
    - IPAddress
    - AutonomousSystemNumber
    - AppDisplayName
    - RoleName
    - Location
    - DeviceDetail
    - AuthenticationRequirement
    - ResultType
    - CorrelationId


# =============================================================================
# HUNTING QUERIES (KQL - Microsoft Sentinel)
# These supplement the Sigma rules with aggregation-based threat hunting
# Run on-demand or schedule as Analytics Rules in Sentinel
# =============================================================================

# HUNT 1: Intune Wipe Volume Spike
# -----------------------------------------------------------------------
# IntuneAuditLogs
# | where TimeGenerated > ago(24h)
# | where OperationName has_any ("wipe", "Retire", "deleteDevice")
# | where ResultStatus == "Success"
# | summarize WipeCount=count(), Devices=make_set(TargetObjectName) by Actor_UPN=tostring(parse_json(Actor).UPN), bin(TimeGenerated, 15m)
# | where WipeCount > 5
# | order by WipeCount desc

# HUNT 2: AS14593 (Starlink) in Entra Sign-In Logs
# -----------------------------------------------------------------------
# SigninLogs
# | where TimeGenerated > ago(7d)
# | extend ASN = tostring(parse_json(NetworkLocationDetails)[0].networkNames[0])
# | where ASN contains "14593" or ASN contains "SPACEX" or ASN contains "Starlink"
# | where AppDisplayName has_any ("Intune", "Azure Portal", "Microsoft 365 admin", "Endpoint Manager")
# | project TimeGenerated, UserPrincipalName, IPAddress, ASN, AppDisplayName, ResultType, Location

# HUNT 3: Admin Role Grants in Past 72 Hours
# -----------------------------------------------------------------------
# AuditLogs
# | where TimeGenerated > ago(72h)
# | where OperationName == "Add member to role"
# | extend TargetUser = tostring(TargetResources[0].userPrincipalName)
# | extend RoleAssigned = tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue)
# | where RoleAssigned has_any ("Global Administrator","Intune Administrator","Cloud Device Administrator")
# | project TimeGenerated, InitiatedBy, TargetUser, RoleAssigned, CorrelationId

# HUNT 4: Iranian ASN Space Hitting Entra ID
# -----------------------------------------------------------------------
# SigninLogs
# | where TimeGenerated > ago(30d)
# | extend ASN = toint(parse_json(NetworkLocationDetails)[0].asn)
# | where ASN in (12880, 48159, 44244, 197207, 43754, 25124, 42337, 31549, 39650, 48434, 58224, 24631, 21341, 50810, 44285)
# | where ResultType == "0"
# | project TimeGenerated, UserPrincipalName, IPAddress, ASN, AppDisplayName, RoleName=tostring(parse_json(DeviceDetail).operatingSystem)

# =============================================================================
# OPENEARCH / ELASTIC EQUIVALENTS
# For orgs running OpenSearch-based SIEMs (Argillite, Splunk, etc.)
# =============================================================================

# OPENSEARCH HUNT 1: Intune Wipe Events
# -----------------------------------------------------------------------
# {
#   "query": {
#     "bool": {
#       "must": [
#         { "terms": { "OperationName": ["remotewipe","Wipe","RetireAndWipe","deleteDevice"] }},
#         { "term": { "ResultStatus": "Success" }},
#         { "range": { "@timestamp": { "gte": "now-24h" }}}
#       ]
#     }
#   },
#   "aggs": {
#     "by_actor": {
#       "terms": { "field": "Actor.UPN", "size": 50 },
#       "aggs": { "wipe_count": { "value_count": { "field": "TargetObjectName" }}}
#     }
#   }
# }

# OPENSEARCH HUNT 2: Starlink ASN Authentication
# -----------------------------------------------------------------------
# {
#   "query": {
#     "bool": {
#       "must": [
#         { "term": { "network.autonomous_system.number": 14593 }},
#         { "terms": { "app.name": ["Microsoft Intune","Azure Portal","Microsoft 365 admin center"] }},
#         { "term": { "event.outcome": "success" }}
#       ]
#     }
#   }
# }
