ATT&CK T1566.002 - Possible Phishing Landing Page

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects potential phishing landing pages by looking for HTTP responses that contain both 'login' and 'microsoft' in the URI, and where the HTTP host is an IP address. This combination suggests an attempt to mimic a Microsoft login page hosted on an IP address rather than a legitimate domain, which is a common tactic in phishing attacks.