Montana Empire Phishing Panel - /mentalite.php Branding Artifacts Detected

Duo Tech@duotech

•updated Jul 1, 2026•1•0•2

This rule monitors outbound HTTP responses to detect the presence of the Montana Empire phishing panel by analyzing specific branding artifacts, such as strings like 'ENTER THE EMPIRE', '256-bit Encrypted', and 'Brute-force Protected' located within the HTTP response body associated with the URI '/mentalite.php'.