[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuVd9vKx3R6LdqWbI0lZH5_gU5QzDzjkdJR8W41NePuc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":27,"status":28,"created_at":29,"published_at":30,"article":31,"tags":35,"podcasts":54,"controls":55},"e07a650f-95c0-4901-b512-7518c4f214c7","hollowgraph-malware-abuses-microsoft-graph-api-for-covert-c2-via-calendar-events","bb21cea7-e18b-468f-9047-2af6e14c5d99","HollowGraph Malware Abuses Microsoft Graph API for Covert C2 via Calendar Events","HollowGraph exploits legitimate Microsoft 365 infrastructure — specifically Graph API calendar events — to blend malicious command-and-control traffic with normal business communications, making it extremely difficult to detect through traditional network monitoring. This 'living-off-trusted-services' technique means perimeter defenses and signature-based tools are largely blind to the threat, as the malicious traffic appears indistinguishable from routine Microsoft 365 activity. The use of DNS tunneling for credential updates adds a secondary covert channel, compounding detection difficulty. Organizations that lack deep behavioral monitoring of Microsoft 365 API activity and outbound DNS patterns are particularly exposed. This attack underscores why defenders must treat trusted cloud platforms as potential attack surfaces, not inherently safe channels.","**Immediate actions:**\n- Audit and restrict OAuth application permissions in Microsoft 365 to enforce least-privilege access to Graph API scopes, especially calendar read\u002Fwrite.\n- Enable Microsoft Defender for Cloud Apps (or equivalent CASB) to alert on anomalous Graph API usage patterns, including unusual calendar event creation or modification volumes.\n- Block or inspect DNS-over-HTTPS and flag anomalous DNS query volumes from endpoints that may indicate tunneling activity.\n\n**Long-term improvements:**\n- Implement Conditional Access policies that restrict Microsoft 365 access to managed, compliant devices and known geographic regions to reduce the attack surface for compromised mailboxes.\n- Deploy a SIEM with Microsoft 365 unified audit log ingestion and build detection rules specifically targeting Graph API calls from non-standard user agents or service accounts.\n- Establish a baseline of normal Microsoft Graph API activity per user and alert on statistical deviations that may indicate automated malware-driven interactions.\n\n**Detection measures:**\n- Hunt for calendar events containing encoded or encrypted payloads by monitoring the Graph API `\u002Fevents` endpoint for unusually large or structured event bodies.\n- Correlate Microsoft 365 sign-in logs with endpoint telemetry to identify accounts accessing Graph API from systems that do not match the user's typical behavior profile.\n- Subscribe to Microsoft threat intelligence feeds and integrate IoCs related to Cavern framework activity into your SIEM and EDR platforms.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25,26],"CIS Control 3: Data Protection","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 CA-7: Continuous Monitoring","MITRE ATT&CK T1071.001: Application Layer Protocol – Web Protocols","MITRE ATT&CK T1048: Exfiltration Over Alternative Protocol","MITRE ATT&CK T1071.004: Application Layer Protocol – DNS","MITRE ATT&CK T1550.001: Use Alternate Authentication Material – Application Access Token","GDPR Article 32: Security of Processing (for EU-adjacent supply chain considerations)","ITIL Change Management: Controlling OAuth app registration and API permission changes",{},"published","2026-07-20T18:20:27.214951+00:00","2026-07-20T18:20:26.927+00:00",{"id":7,"url":32,"slug":33,"title":34},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms\u002F","new-hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2-comms-18666f","New HollowGraph malware uses Microsoft Graph for stealthy C2 comms",[36,42,48],{"id":37,"name":38,"slug":39,"description":40,"color":41},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":43,"name":44,"slug":45,"description":46,"color":47},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":49,"name":50,"slug":51,"description":52,"color":53},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[56,60,64],{"slug":57,"name":58,"problem":59},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":61,"name":62,"problem":63},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":65,"name":66,"problem":67},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]