TONResolver Booking.com Phishing with invite.ics and Guest Complaint Lure
Detects phishing emails associated with the TONResolver RAT campaign that impersonate Booking.com partner support. The emails use Japanese-language lures concerning guest complaints, include 'invite.ics' calendar attachments, and contain URLs pointing to suspicious top-level domains (.cfd, .bond, .sbs, .shop) or specific 'photo-' URL patterns. The rule differentiates between malicious impersonation and legitimate booking.com domain traffic.
Sigma
