Social Engineering Referral from X.com to Malicious Google Doc Lure
This rule detects network HTTP requests directed toward Google Scripts (script.google.com) or Google Docs (docs.google.com) where the referrer originates from Twitter or X. It further flags requests containing suspicious keywords like 'coindesk', 'conference', or 'hartmansdoeke', which are often associated with credential harvesting or malicious redirection campaigns leveraging trusted platforms.
Cortex XDR
