Scattered Spider Phishing Domain Patterns
Detects network connections to domains matching patterns commonly used by the Scattered Spider threat group for phishing campaigns. The group often registers domains that mimic legitimate corporate services by appending suffixes like "-sso", "-servicedesk", "-okta", "-vpn", or "-helpdesk" to a target's name (e.g., victim-sso.com).
Sigma
