Fake Microsoft Login Page for Credential Harvest

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects attempts to harvest credentials using a fake Microsoft login page. It triggers when HTTP traffic from the server to the client contains both "microsoftonline" and "password" in the file data, and the HTTP host is an IP address. This combination suggests a phishing attempt where a malicious server is impersonating a Microsoft login page to capture user credentials.