Google Sites GlobalProtect Phishing Leads to Unsigned MSI Download

Arnold Chan@slaz

•updated 8 days ago•3•0•5

This rule correlates web clicks on Google Sites URLs containing keywords related to GlobalProtect with the subsequent creation or renaming of an unsigned or improperly signed GlobalProtect.msi file on the same endpoint within a 30-minute window. This behavior is indicative of a spearphishing attempt using a masqueraded landing page to deliver malicious or unauthorized software.