Detection rules › Kusto
Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
'Detects when an HTTP request was made to a domain that was using unicode/punycode.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1566 Phishing |
Rule body kusto
id: 6b579e98-abc9-4e7a-9efc-2f3408ba16c9
name: Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
description: |
'Detects when an HTTP request was made to a domain that was using unicode/punycode.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: Corelight
dataTypes:
- Corelight_v2_http
- corelight_http
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
corelight_http
| where method =~ 'GET'
| where isempty(referrer)
| where host has 'xn--'
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: id_orig_h
version: 2.1.0
kind: Scheduled
Stages and Predicates
Stage 1: source
corelight_http
Stage 2: where
| where method =~ 'GET'
Stage 3: where
| where isempty(referrer)
Stage 4: where
| where host has 'xn--'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.