Credential Phishing Redirect Link Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects potential credential phishing attempts by identifying HTTP URIs that contain the keywords 'redirect', 'login', and 'microsoft' (case-insensitive). This combination of keywords in a URI is often indicative of a phishing link designed to trick users into providing credentials, especially targeting Microsoft accounts, by redirecting them to a fake login page.