SMOKE#SCREEN Fake Zoom/Flash Phishing + Auto-Download Timer + Dropbox Payload (Correlated)
Detects correlated SMOKE#SCREEN activity where a victim host is served a fake Zoom/Flash update lure, an HTTP response containing a JavaScript auto-download trigger, and a Dropbox-hosted payload link, all within the same hourly window.
Cortex XDR
