Detection rules › Kusto
Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
'Detects when an HTTP request was made to a domain that was using unicode/punycode.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: 6b579e98-abc9-4e7a-9efc-2f3408ba16c9
name: Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
description: |
'Detects when an HTTP request was made to a domain that was using unicode/punycode.'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: Corelight
dataTypes:
- Corelight_v2_http
- corelight_http
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1566
query: |
corelight_http
| where method =~ 'GET'
| where isempty(referrer)
| where host has 'xn--'
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: id_orig_h
version: 2.1.0
kind: Scheduled
Stages and Predicates
Stage 1: source
corelight_http
Stage 2: where
| where method =~ 'GET'
Stage 3: where
| where isempty(referrer)
Stage 4: where
| where host has 'xn--'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
host | match |
| field:"host" kind:match value:"xn--" |
method | eq |
| field:"method" kind:eq value:"GET" |
referrer | is_null | field:"referrer" kind:is_null |