Files
splunk-security_content/macros/evilginx_phishlets_amazon.yml
2019-10-16 16:38:05 +02:00

5 lines
207 B
YAML

definition: (query=fls-na* AND query = www* AND query=images*)
description: This limits the query fields to domains that are associated with evilginx
masquerading as Amazon
name: evilginx_phishlets_amazon