Update and rename rakuten-88426540.yml to Config-88426540.yml

Detect phishing sites that use ResourceRedConfig.js and urlConfig.json
phish-report · Feb 8, 2024 · 1cdf5ec · 1cdf5ec
1 parent a935b10
commit 1cdf5ec
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 26 deletions.
diff --git a/indicators/Config-88426540.yml b/indicators/Config-88426540.yml
@@ -0,0 +1,22 @@
+title: ResourceRedConfig and urlConfig Detection 88426540
+description: |
+    Detect phishing sites that use ResourceRedConfig.js and urlConfig.json
+references:
+  - https://urlscan.io/result/88426540-8f66-4fe2-b8f2-526e7025ace7
+  - https://urlscan.io/result/05189f5c-f969-45da-a6fd-d3fec490f0f7
+  - https://urlscan.io/result/d4886a4c-114a-4a0a-9b07-614fddc6171f
+
+detection:
+
+    ResourceRedConfig:
+        requests|contains: 'ResourceRedConfig.js'
+
+    urlConfig:
+        requests|contains: 'urlConfig.json'
+
+    condition: ResourceRedConfig and urlConfig
+
+tags:
+  - kit
+  - target.rakuten
+  - target_country.japan
diff --git a/indicators/rakuten-88426540.yml b/indicators/rakuten-88426540.yml