Phishing Recon Form Collecting Org Data

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects HTTP POST requests where the client body contains the keywords 'company', 'role', and 'email' (case-insensitive). This combination of keywords in a POST request body is indicative of a phishing reconnaissance attempt, where an attacker is trying to collect organizational data through a form submission.