ATT&CK T1589 - Possible Credential Harvesting Page Access

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•6

This rule detects HTTP requests to a server that contain both 'password' and 'username' in the URI, case-insensitively. This pattern is indicative of a potential credential harvesting attempt where an attacker is trying to collect user credentials via a crafted web page or phishing site. The rule specifically looks for these keywords in the URI of an established HTTP connection flowing to the server.