Phishing link to fake Boeing/Airbus/Teledyne FLIR recruitment portal (teledyneflir.com.de)
This rule monitors network traffic for DNS queries or remote IP connections to domains that appear to be typosquatting or lookalike domains targeting specific organizations (Boeing, Airbus, Teledyne FLIR). The rule identifies potential phishing or malicious infrastructure by looking for the string 'career' combined with specific entity names or specific suspicious TLD patterns like '.com.de'.
Cortex XDR
