GhostCode Phishing Kit - Malicious Domain Communication

Ankit Mehta@Secvyn

•updated 23 days ago•0•0•1

This rule detects internal network activity (DNS queries, network connections, and security logs) communicating with domains associated with the GhostCode phishing kit. These domains are typically used to host credential harvesting pages or phishing infrastructure.