Tycoon2FA Kit URL Parameters
Identifies network traffic containing the distinct 'bltpg' and 'sid' parameters used by the Tycoon2FA credential harvesting platform. This rule specifically looks for HTTP network data containing both 'bltpg=' and 'sid=' within the action_network_http field, which are indicative of the Tycoon2FA phishing kit's communication patterns. The rule then deduplicates alerts based on agent hostname and remote IP to reduce alert volume.
Cortex XDR
