detecting_phishing_domains_proxy

Description

This rule detects network connections to Phishing domains. License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md.

Query · yara_l

events:
(($selection_URLs_1.target.url = "com-managers-updateds-notifications-accounts.com" or $selection_URLs_1.target.url = "com-updated-manager-notifications-accounts.info" or $selection_URLs_1.target.url = "com-index-managers-updateds-notifications-accounts.com" or $selection_URLs_1.target.url = "com-notice-index-managers-review-accounts.com" or $selection_URLs_1.target.url = "appleid.com-notice-index-managers-review-accounts.com" or $selection_URLs_1.target.url = "appleid.com-index-managers-updateds-notifications-accounts.com" or $selection_URLs_1.target.url = "appleid.com-updated-manager-notifications-accounts.info" or $selection_URLs_1.target.url = "appleid.com-manager-updateds-account-notifeds.com" or $selection_URLs_1.target.url = "com-manager-updateds-account-notifeds.com" or $selection_URLs_1.target.url = "appleid.com-managers-updateds-notifications-accounts.com" or $selection_URLs_1.target.url = "appleid.com-index-managers-updateds-notifications-accounts.info" or $selection_URLs_1.target.url = "com-index-managers-updateds-notifications-accounts.info") or ($selection_URLs_1.target.url = "com-authenticationid-account-id-291175.com" or $selection_URLs_1.target.url = "com-authentication-account-id-67800.com" or $selection_URLs_1.target.url = "account-signinid.com-authentication-account-id-67800.com" or $selection_URLs_1.target.url = "com-reviewid-account-authenticationid-11250.com" or $selection_URLs_1.target.url = "com-authentication-account-id-67991.com" or $selection_URLs_1.target.url = "accountid-signin.com-authenticationid-account-id-291175.com") or ($selection_URLs_1.target.url = "reverify-id-apple.com" or $selection_URLs_1.target.url = "re-verify-id-apple.com" or $selection_URLs_1.target.url = "reverify-id-apple.com" or $selection_URLs_1.target.url = "un-verify-id-apple.com" or $selection_URLs_1.target.url = "unverify-id-apple.com" or $selection_URLs_1.target.url = "re-verify-id-apple.com" or $selection_URLs_1.target.url = "unverify-id-apple.com" or $selection_URLs_1.target.url = "www.unverify-id-apple.com" or $selection_URLs_1.target.url = "un-verify-id-apple.com" or $selection_URLs_1.target.url = "wazze-design.com" or $selection_URLs_1.target.url = "www.wazze-design.com" or $selection_URLs_1.target.url = "www.re-verify-id-apple.com" or $selection_URLs_1.target.url = "www.reverify-id-apple.com" or $selection_URLs_1.target.url = "www.un-verify-id-apple.com" or $selection_URLs_1.target.url = "ns1.stitis.com" or $selection_URLs_1.target.url = "ns2.stitis.com" or $selection_URLs_1.target.url = "disable-id-apple.com" or $selection_URLs_1.target.url = "www.support-id-icloud.com" or $selection_URLs_1.target.url = "apple.com-verif-id.app") or ($selection_URLs_1.target.url = "pages-secure.com-verifications-account-webservices-appleid.com" or $selection_URLs_1.target.url = "com-verifications-account-webservices-appleid.com" or $selection_URLs_1.target.url = "com-verifications-account-webservices-appleid.com" or $selection_URLs_1.target.url = "com-page-secure-webmail-supportcenter.com" or $selection_URLs_1.target.url = "identification-account.com-page-secure-webmail-supportcenter.com" or $selection_URLs_1.target.url = "www.com-page-secure-webmail-supportcenter.com" or $selection_URLs_1.target.url = "com-page-secure-webmail-supportcenter.com"))

  condition:
    $selection_URLs_1
Raw source detecting_phishing_domains_proxy · YARA-L
Esc
Published by chronicle/detection-rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule detecting_phishing_domains_proxy {
 meta:
    author = "Dmitriy Dyakon, SOC Prime"
    description = "This rule detects network connections to Phishing domains.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/CeUkPKroNAZ7"
    version = "0.01"
    created = "2021-03-09"
    product = "proxy"
    mitre = "Command and Control, t1071"

  events:
(($selection_URLs_1.target.url = "com-managers-updateds-notifications-accounts.com" or $selection_URLs_1.target.url = "com-updated-manager-notifications-accounts.info" or $selection_URLs_1.target.url = "com-index-managers-updateds-notifications-accounts.com" or $selection_URLs_1.target.url = "com-notice-index-managers-review-accounts.com" or $selection_URLs_1.target.url = "appleid.com-notice-index-managers-review-accounts.com" or $selection_URLs_1.target.url = "appleid.com-index-managers-updateds-notifications-accounts.com" or $selection_URLs_1.target.url = "appleid.com-updated-manager-notifications-accounts.info" or $selection_URLs_1.target.url = "appleid.com-manager-updateds-account-notifeds.com" or $selection_URLs_1.target.url = "com-manager-updateds-account-notifeds.com" or $selection_URLs_1.target.url = "appleid.com-managers-updateds-notifications-accounts.com" or $selection_URLs_1.target.url = "appleid.com-index-managers-updateds-notifications-accounts.info" or $selection_URLs_1.target.url = "com-index-managers-updateds-notifications-accounts.info") or ($selection_URLs_1.target.url = "com-authenticationid-account-id-291175.com" or $selection_URLs_1.target.url = "com-authentication-account-id-67800.com" or $selection_URLs_1.target.url = "account-signinid.com-authentication-account-id-67800.com" or $selection_URLs_1.target.url = "com-reviewid-account-authenticationid-11250.com" or $selection_URLs_1.target.url = "com-authentication-account-id-67991.com" or $selection_URLs_1.target.url = "accountid-signin.com-authenticationid-account-id-291175.com") or ($selection_URLs_1.target.url = "reverify-id-apple.com" or $selection_URLs_1.target.url = "re-verify-id-apple.com" or $selection_URLs_1.target.url = "reverify-id-apple.com" or $selection_URLs_1.target.url = "un-verify-id-apple.com" or $selection_URLs_1.target.url = "unverify-id-apple.com" or $selection_URLs_1.target.url = "re-verify-id-apple.com" or $selection_URLs_1.target.url = "unverify-id-apple.com" or $selection_URLs_1.target.url = "www.unverify-id-apple.com" or $selection_URLs_1.target.url = "un-verify-id-apple.com" or $selection_URLs_1.target.url = "wazze-design.com" or $selection_URLs_1.target.url = "www.wazze-design.com" or $selection_URLs_1.target.url = "www.re-verify-id-apple.com" or $selection_URLs_1.target.url = "www.reverify-id-apple.com" or $selection_URLs_1.target.url = "www.un-verify-id-apple.com" or $selection_URLs_1.target.url = "ns1.stitis.com" or $selection_URLs_1.target.url = "ns2.stitis.com" or $selection_URLs_1.target.url = "disable-id-apple.com" or $selection_URLs_1.target.url = "www.support-id-icloud.com" or $selection_URLs_1.target.url = "apple.com-verif-id.app") or ($selection_URLs_1.target.url = "pages-secure.com-verifications-account-webservices-appleid.com" or $selection_URLs_1.target.url = "com-verifications-account-webservices-appleid.com" or $selection_URLs_1.target.url = "com-verifications-account-webservices-appleid.com" or $selection_URLs_1.target.url = "com-page-secure-webmail-supportcenter.com" or $selection_URLs_1.target.url = "identification-account.com-page-secure-webmail-supportcenter.com" or $selection_URLs_1.target.url = "www.com-page-secure-webmail-supportcenter.com" or $selection_URLs_1.target.url = "com-page-secure-webmail-supportcenter.com"))

  condition:
    $selection_URLs_1
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.