mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
42 lines
2.6 KiB
JSON
42 lines
2.6 KiB
JSON
{
|
|
"category": [
|
|
"Adversary Tactics"
|
|
],
|
|
"channel": "ESCU",
|
|
"creation_date": "2019-04-29",
|
|
"description": "Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. ",
|
|
"detections": [
|
|
{
|
|
"detection_id": "24dd17b1-e2fb-4c31-878c-d4f226595bfa",
|
|
"name": "Detect DNS requests to Phishing Sites leveraging EvilGinx2",
|
|
"type": "splunk"
|
|
}
|
|
],
|
|
"id": "9a64ab44-9214-4639-8163-7eaa2621bd61",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "research@splunk.com",
|
|
"name": "Splunk Research Team"
|
|
}
|
|
],
|
|
"modification_date": "2019-04-29",
|
|
"name": "Common Phishing Frameworks",
|
|
"narrative": "As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.<br></br>This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2.",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "research@splunk.com",
|
|
"name": "Splunk Research Team"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://github.com/kgretzky/evilginx2",
|
|
"https://attack.mitre.org/techniques/T1192/",
|
|
"https://breakdev.org/evilginx-advanced-phishing-with-two-factor-authentication-bypass/"
|
|
],
|
|
"spec_version": 2,
|
|
"usecase": "Advanced Threat Detection",
|
|
"version": "1.0"
|
|
}
|