5-Minute Hunt: Six Queries to Detect Iranian APT Activity by Lucie Cardiet

This Vectra 5-Minute Hunt guide provides detection queries, IOCs, MITRE mappings, and investigation steps to surface activity from Iran-aligned actors (APT35/Charming Kitten and APT34/OilRig) and QasarRAT-related infrastructure; it highlights Pupy and SpyNote deployments, credential harvesting and device-registration abuse in Microsoft 365, and dynamic-DNS-based C2 patterns, with recommended validations, pivots, and remediation actions.