1
0
Форкнуть 0

Update Qakbot Craigslist Domains.md

This commit is contained in:
Michael Cyr 2021-11-02 12:42:17 -07:00 коммит произвёл GitHub
Родитель 475dec17ca
Коммит c3face98fe
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
1 изменённых файлов: 1 добавлений и 1 удалений

Просмотреть файл

@ -2,7 +2,7 @@
Qakbot operators have been observed using the Craigslist messaging system as a lure in malicious emails. These emails contain non-clickable links to malicious domains impersonating Craigslist, which the user is instructed to manually type into the address bar to access.
## Query
This query looks for network connections to domains impersonating Craigslists and are associated with the delivery of Qakbot.
This query looks for network connections to domains impersonating Craigslist which are associated with the delivery of Qakbot.
```
DeviceNetworkEvents
| where RemoteUrl matches regex @"abuse\.[a-zA-Z]\d{2}-craigslist\.org"