Check IOCs- Inside Knight Office, a New M365 AiTM Phishing Kit

Ankit Mehta@Secvyn

•updated Sep 3, 2026•0•0•1

This rule identifies phishing attempts by detecting inbound emails where the sender's domain or any embedded URLs within the email content match a pre-defined list of known malicious domains. It flags emails for further investigation by correlating sender domain data and URL information found in the email communication.