Signal Phishing Campaign Infrastructure Access
This rule detects network connections or DNS queries to a list of domains identified as phishing campaign infrastructure. These domains are associated with a 'Signal Phishing Campaign' and are likely used for malicious purposes such as credential harvesting or malware distribution. The rule checks for these domains in `RemoteUrl` or `DestinationHost` fields across various network-related logs.
Microsoft Sentinel (KQL)
