the_gocgle_malicious_campaign

rule the_gocgle_malicious_campaign {
 meta:
    author = "Osman Demir"
    description = "Detects Web Skimming Attacks  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/LI0qbtGS0Jtv"
    version = "0.01"
    created = "2021-03-09"
    category = "proxy"
    mitre = "T1056, Collection"

  events:
(($selection.principal.hostname = "gocgle-analytics.net" or $selection.principal.hostname = "googlo-analytics.com" or $selection.principal.hostname = "gocgletagmanager.com" or $selection.principal.hostname = "googlc-analytics.com" or $selection.principal.hostname = "gocgle-analytics.cm" or $selection.principal.hostname = "gocgletagmanager.cm" or $selection.principal.hostname = "gocgle-analytics.com" or $selection.principal.hostname = "analytic.is" or $selection.principal.hostname = "qdtf54y6eu7i87t.ga") or ($selection.target.ip = "5.188.9.61" or $selection.target.ip = "5.188.9.33" or $selection.target.ip = "5.188.9.40" or $selection.target.ip = "194.180.224.112"))

  condition:
    $selection
}