Kratos phishing kit credential exfiltration POST to save.php
Detects HTTP POST requests directed at a '/save.php' URI, a common signature associated with the Kratos phishing kit used for capturing and exfiltrating user credentials.
Suricata
Detects HTTP POST requests directed at a '/save.php' URI, a common signature associated with the Kratos phishing kit used for capturing and exfiltrating user credentials.
Already have an account?