Legal-Threat Gmail Phishing via URL Shortener Bypassing SPF/DKIM/DMARC
Detects DNS queries originating from endpoints to common URL shortening services such as bit.ly, goo.gl, and others. These services are frequently abused by adversaries for C2 communications, distributing malware, or phishing, as they can mask malicious destination URLs.
Cortex XDR
