mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
36 lines
2.1 KiB
YAML
36 lines
2.1 KiB
YAML
name: Common Phishing Frameworks
|
|
id: 9a64ab44-9214-4639-8163-7eaa2621bd61
|
|
version: 1
|
|
date: '2019-04-29'
|
|
description: 'Detect DNS and web requests to fake websites generated by the EvilGinx2
|
|
toolkit. These websites are designed to fool unwitting users who have clicked on
|
|
a malicious link in a phishing email. '
|
|
narrative: 'As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/),
|
|
familiar contact names inserted as senders, and other tactics to lure targets into
|
|
clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/),
|
|
or entering sensitive personal information that perpetrators may intercept. This
|
|
attack technique requires a relatively low level of skill and allows adversaries
|
|
to easily cast a wide net. Because phishing is a technique that relies on human
|
|
psychology, you will never be able to eliminate this vulnerability 100%. But you
|
|
can use automated detection to significantly reduce the risks.\
|
|
|
|
This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2),
|
|
a toolkit that sets up a transparent proxy between the targeted site and the user.
|
|
In this way, the attacker is able to intercept credentials and two-factor identification
|
|
tokens. It employs a proxy template to allow a registered domain to impersonate
|
|
targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit,
|
|
Office 365, and others. It can even register SSL certificates and camouflage them
|
|
via a URL shortener, making them difficult to detect. Searches in this story look
|
|
for signs of MiTM attacks enabled by EvilGinx2.'
|
|
author: Splunk Research Team, Splunk
|
|
type: ESCU
|
|
references:
|
|
- https://github.com/kgretzky/evilginx2
|
|
- https://attack.mitre.org/techniques/T1192/
|
|
- https://breakdev.org/evilginx-advanced-phishing-with-two-factor-authentication-bypass/
|
|
tags:
|
|
analytics_story: Common Phishing Frameworks
|
|
usecase: Advanced Threat Detection
|
|
category:
|
|
- Adversary Tactics
|