Storm-2755 - Targeted Payroll Phishing Navigation (T1566.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•12

Detects users clicking links from emails containing Canadian payroll lures leading to fake Workday/ADP domains. The rule specifically looks for navigation to URLs matching a regex pattern for Workday, ADP, or payroll-related terms combined with login/auth/secure keywords, and correlates this with browser process events (Chrome or Edge).