add yml

phish-report · Sep 5, 2023 · 6d6ec66 · 6d6ec66
1 parent 0afe234
commit 6d6ec66
Showing 1 changed file with 21 additions and 0 deletions.
diff --git a/indicators/saison-b85570be.yml b/indicators/saison-b85570be.yml
@@ -0,0 +1,21 @@
+title: SAISON Card Phishing Kit b85570be
+description: |
+    Detects a SAISON Card phishing kit targeting Japanese users.
+
+references:
+  - https://urlscan.io/result/b85570be-adc3-45f8-83ee-9a4a46737f89
+  - https://urlscan.io/result/4332baf6-7b01-49e9-9d88-b7dcb9ad5a33
+  - https://urlscan.io/result/7ddc9c4a-2a7d-403d-9743-82cb62f0eb02
+
+detection:
+    FormContains: 
+        html|contains: 
+            - 'name="loginForm" id="loginForm" method="post" action="USA0201UIP01SCR.do.php"'
+    pagePHP:
+        requests|contains: 'auth.php'
+
+    condition: FormContains and pagePHP
+
+tags:
+  - target.saison
+  - target_country.japan