GS7 Phishing Subdomain Pattern
Detects DNS queries for subdomains that match a specific pattern used by the threat actor GS7. The actor uses a semi-automated infrastructure with highly specific subdomain naming conventions, such as 'rss.[random]-auth.com' or 'cpcalendars.[random]-verify.online', to host phishing pages and payloads.
Sigma
