EvilTokens X-Antibot-Token Header Detection
Identifies HTTP requests containing the custom 'X-Antibot-Token' header used by the EvilTokens phishing kit to validate interactions and evade automated scanners. This header is highly specific to the EvilTokens PhaaS and its presence indicates malicious activity.
Microsoft Sentinel (KQL)
