Fake DocuSign/NFe Lure Page with Multi-Signal Anti-Bot Gating
This rule detects sophisticated phishing lure pages impersonating DocuSign or NFe documentation. It specifically identifies pages that implement multi-layered anti-bot gating techniques, including detection of browser automation (navigator.webdriver), identification of headless browser artifacts (headless/HeadlessChrome), and the presence of interaction-wait fallback timers using addEventListener, all tied to specific malicious content indicators.
Microsoft Sentinel (KQL)
