diff --git a/indicators/valorant-7plil474.yml b/indicators/valorant-7plil474.yml new file mode 100644 index 00000000..5057581d --- /dev/null +++ b/indicators/valorant-7plil474.yml @@ -0,0 +1,32 @@ +title: Valorant Phishing Kit 7plil474 +description: | + Detects a phishing kit targeting Valorant players. It is typically spread on + social media platforms such as TikTok, often luring in gamers using popular + figures such as Tenz, Kyedae and MrBeast. + +references: + - https://www.tiktok.com/search/video?q=mrbeast%20valorant + - https://urlscan.io/result/ceb1f3d8-efed-40b3-85e4-6c9eecd182b7/ + - https://urlscan.io/result/48118e59-979c-48e7-b332-bb802dc5e941/ + - https://urlscan.io/result/5421601f-f2aa-41a5-bf6b-85a264bee2f7/ + +detection: + + requests: + requests|endswith|all: + - '/login' + - 'logins.css' + - '/t/1.css?apiType=css&projectid=dce2cd3c-2b49-496c-8fe8-f7eedea7aa2b' + + jsVariables: + js|contains|all: + - 'makeid' + - 'rqdata_token' + - 'login_mfa' + + condition: requests and jsVariables + +tags: + - kit + - target.valorant + - target.riotgames diff --git a/indicators/valorant-landing-page-7plil474.yml b/indicators/valorant-landing-page-7plil474.yml new file mode 100644 index 00000000..49eec5cd --- /dev/null +++ b/indicators/valorant-landing-page-7plil474.yml @@ -0,0 +1,28 @@ +title: Valorant Phishing Kit Landing Page 7plil474 +description: | + Detects the landing pages used by the phishing kit detected by the valorant-7plil474 rule. +references: + - https://www.tiktok.com/search/video?q=mrbeast%20valorant + - https://urlscan.io/result/35050e0b-f38d-4671-8728-489538351167/ + - https://urlscan.io/result/fb92d735-7209-48dc-8c06-0c23f013f0ef/ + - https://urlscan.io/result/9ced04ab-e67e-4ac5-9d9c-0993f69f3f55/ + - https://urlscan.io/result/e6f5c3bc-85e6-4fda-a276-709c52ac403b/ +related: + - id: valorant-7plil474 + +detection: + + jsVariables: + js|contains|all: + - 'start' + - 'checkAlreadyGot' + - 'getItem' + - 'getRandom' + - 'generateItems' + + condition: jsVariables + +tags: + - kit + - target.valorant + - target.riotgames