Kali365 / EvilTokens - Desktop App User-Agent (kali365-live/1.0.0)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•4•0•8

Detects sign-ins utilizing the Kali365 Live desktop application User-Agent, which is associated with the EvilTokens threat actor tooling. This rule specifically looks for the User-Agent string "kali365-live/1.0.0" in sign-in logs.