LegionLoader Spearphishing: Distribution Settlement Agreement PDF from gasparinutrition.com
This rule monitors for suspicious emails involving the 'gasparinutrition.com' domain, specifically looking for indicators such as DMARC failures, spoofed display names (e.g., 'monitoring'), or attachments with file names related to business documents like distribution, settlement, or agreements. It also triggers on DNS queries for the same domain, which could indicate related outbound communications or C2 activity.
Cortex XDR
