Ousaban Phishing PDF Lure Attachment Linking to facture-in.pages.dev
This rule detects potential phishing activity by monitoring for the creation of specific PDF files matching common financial-themed lures and network connections to a known malicious domain 'facture-in.pages.dev'. It tracks file-based lure indicators on local devices and network requests to identify potential initial access or delivery stages of an attack.
Microsoft Sentinel (KQL)
