Push Security Phishing Attack

Query · python

def rule(event):
    if event.get("object") == "PASSWORD_PHISHING":
        return True

    return False


def severity(event):
    if event.deep_get("new", "mode") != "BLOCK":
        return "HIGH"
    return "LOW"


def title(event):
    app_type = event.deep_get("new", "appType")
    employee_email = event.deep_get("new", "employee", "email")
    new_mode = event.deep_get("new", "mode")
    return f"Phishing attack on app {app_type} user {employee_email}. \
             Attack detected in mode {new_mode}."
Raw source Push Security Phishing Attack · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: push_security_phishing_attack.py
RuleID: "Push.Security.Phishing.Attack"
DisplayName: "Push Security Phishing Attack"
Enabled: true
LogTypes:
  - PushSecurity.Controls
Severity: High
DedupPeriodMinutes: 60
Threshold: 1
Tests:
  - Name: Phishing Detected - Block Mode
    ExpectedResult: true
    Log:
      id: c478966c-f927-411c-b919-179832d3d50c
      new:
        appType: OKTA
        browser: CHROME
        employee:
          chatopsEnabled: true
          creationTimestamp: 1.698669223e+09
          department: Security Engineering
          email: john.hill@example.com
          firstName: John
          id: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
          lastName: Hill
          licensed: true
          location: New York
        mode: BLOCK
        os: WINDOWS
        referrerUrl: https://statics.teams.cdn.office.net/
        sourceIpAddress: 8.158.25.38
        url: https://evil.com/okta.php
        userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
      object: PASSWORD_PHISHING
      timestamp: 1.698604061e+09
      version: "1"
  - Name: Phishing Detected - Monitor Mode
    ExpectedResult: true
    Log:
      id: c478966c-f927-411c-b919-179832d3d50c
      new:
        appType: OKTA
        browser: CHROME
        employee:
          chatopsEnabled: true
          creationTimestamp: 1.698669223e+09
          department: Security Engineering
          email: john.hill@example.com
          firstName: John
          id: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
          lastName: Hill
          licensed: true
          location: New York
        mode: MONITOR
        os: WINDOWS
        referrerUrl: https://statics.teams.cdn.office.net/
        sourceIpAddress: 8.158.25.38
        url: https://evil.com/okta.php
        userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
      object: PASSWORD_PHISHING
      timestamp: 1.698604061e+09
      version: "1"


# ------ paired body: push_security_phishing_attack.py ------

def rule(event):
    if event.get("object") == "PASSWORD_PHISHING":
        return True

    return False


def severity(event):
    if event.deep_get("new", "mode") != "BLOCK":
        return "HIGH"
    return "LOW"


def title(event):
    app_type = event.deep_get("new", "appType")
    employee_email = event.deep_get("new", "employee", "email")
    new_mode = event.deep_get("new", "mode")
    return f"Phishing attack on app {app_type} user {employee_email}. \
             Attack detected in mode {new_mode}."

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.