FIFA Lure Attachment Launches Script
This rule detects the execution of scripting interpreters (PowerShell, WScript, CScript, MSHTA, CMD) where the initiating process's command line contains keywords related to FIFA or World Cup, suggesting a potential phishing attempt using a themed attachment. The rule aims to identify initial access attempts where users are lured into opening malicious files disguised as legitimate content (e.g., tickets, schedules, streaming links for a major sporting event).
Microsoft Sentinel (KQL)
