From c36e3f4510ef9f0d7e3a8cf494d0b5092d763ff3 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 23 Jul 2026 12:24:02 +1000 Subject: [PATCH] feat: add content signatures for identity verification phishing kit --- rules/detection-rules.json | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/rules/detection-rules.json b/rules/detection-rules.json index ad01d82..ecfd808 100644 --- a/rules/detection-rules.json +++ b/rules/detection-rules.json @@ -1,6 +1,6 @@ { - "version": "1.2.5", - "lastUpdated": "2026-07-08T00:00:00Z", + "version": "1.2.6", + "lastUpdated": "2026-07-23T00:00:00Z", "description": "Phishing detection logic for identifying phishing attempts targeting Microsoft 365 login pages", "trusted_login_patterns": [ "^https:\\/\\/login\\.microsoftonline\\.(com|us)$", @@ -683,6 +683,26 @@ "phishing": 25 }, "phishing_indicators": [ + { + "id": "phi_037_sx_document_origin_custom_background_kit", + "pattern": "(?=[\\s\\S]*window\\.__sxDocumentOrigin)(?=[\\s\\S]*function\\s+apiPath\\s*\\(\\s*value\\s*\\))(?=[\\s\\S]*__customBgStyles)(?=[\\s\\S]*__custom-bg-enabled)", + "flags": "i", + "severity": "critical", + "description": "Credential-phishing kit that proxies API calls through __sxDocumentOrigin and injects a custom-background login layer", + "action": "block", + "category": "phishing_kit_signature", + "confidence": 0.98 + }, + { + "id": "phi_038_fake_microsoft_identity_verification_modal", + "pattern": "(?=[\\s\\S]*Identity\\s+Verification)(?=[\\s\\S]*generate\\s+your\\s+verification\\s+code)(?=[\\s\\S]*I(?:'|'|�*39;|�*27;)m\\s+not\\s+a\\s+robot)(?=[\\s\\S]*Protected\\s+by\\s+Microsoft\\s+Security)", + "flags": "i", + "severity": "critical", + "description": "Fake Microsoft identity-verification modal that tricks users into generating a verification code", + "action": "block", + "category": "brand_abuse", + "confidence": 0.96 + }, { "id": "phi_001", "pattern": "(?:secure-?(?:microsoft|office|365|outlook))",