LegionLoader PDF Credential Harvesting Link via gasparinutrition.com
Detects incoming email messages containing PDF attachments from 'gasparinutrition.com' that either have suspicious filenames indicating legal or contractual documents or contain external links redirecting to non-domain URLs. These indicators are consistent with credential harvesting or phishing campaigns.
Microsoft Sentinel (KQL)
