Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Infra-VishingHelpdeskDomains.
Upgrade to ProDetect Impersonation Domains Acquired to Support Voice Phishing Helpdesk Social Engineering in Google Chronicle
Ahead of a voice-phishing (vishing) campaign, actors such as Scattered Spider register a small cluster of domains that impersonate the target organization's IT helpdesk, SSO portal, or MFA self-service enrollment page (e.g., victimcorp-helpdesk[.]com, victimcorp-sso-verify[.]com, victimcorp-okta[.]net). These domains are stood up shortly before the actor calls or SMS-messages an employee — typically posing as IT support — and directs them to the lookalike page to 'verify their identity' or 're-enroll MFA,' harvesting credentials and a live MFA/push-approval in the process. Because the domain is freshly registered specifically for this operation, it has no browsing history in the target environment prior to the campaign, making the very first DNS query or HTTP request to it a high-value signal. Detection focuses on three pillars: (1) DNS/HTTP traffic to domains combining the organization's brand name with helpdesk/SSO/MFA-themed keywords, (2) first-time-ever resolution of such a domain within the environment (no prior 30-day history), and (3) close temporal correlation between a phone-based social-engineering contact recorded in the ticketing/telephony system and a subsequent authentication event or password/MFA reset for the same user.
MITRE ATT&CK
- Tactic
- Resource Development
YARA-L Detection Query
rule vishing_helpdesk_impersonation_domain {
meta:
author = "Detection Engineering"
description = "Detects DNS resolution of domains combining organization brand token with helpdesk/SSO/MFA keywords, indicative of vishing impersonation infrastructure"
severity = "HIGH"
confidence = "medium"
mitre_attack = "T1583.001"
reference = "https://attack.mitre.org/techniques/T1583/001/"
events:
$e.metadata.event_type = "NETWORK_DNS"
re.regex($e.network.dns.questions.name, `(?i)victimcorp.*(helpdesk|sso|okta|duo|mfa|verify|identity|reset)`)
condition:
$e
}Google Chronicle YARA-L 2.0 detection for DNS resolutions of domains combining the organization's brand token with helpdesk/SSO/MFA-themed keywords — the impersonation infrastructure pattern used to support voice-phishing helpdesk social engineering. Replace 'victimcorp' with the deployment's actual brand token(s).
Data Sources
Required Tables
False Positives & Tuning
- The organization's actual helpdesk/SSO subdomains matching the keyword pattern
- Vendor co-branded IT support portals
- Authorized phishing-simulation platform domains
Other platforms for THREAT-Infra-VishingHelpdeskDomains
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1DNS Query to Brand-Plus-Helpdesk-Keyword Lookalike Domain
Expected signal: Sysmon Event ID 22: DNS Query event with QueryName='victimcorp-helpdesk-verify.com'. The query will likely NXDOMAIN but the DNS attempt is logged regardless.
- Test 2First-Ever Resolution of SSO-Themed Lookalike Domain
Expected signal: Sysmon Event ID 22: QueryName='victimcorp-sso-mfa-reset.net' with no prior resolution history for this exact name in the environment's DNS logs.
- Test 3Simulated Ticketing-System MFA Reset Correlated to a Risk Event
Expected signal: A synthetic ticketing-audit JSON line simulating an MFAMethodAdded action for [email protected] — in a real environment this would be ingested into the SIEM's ServiceDeskAudit_CL-equivalent index.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Infra-VishingHelpdeskDomains — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month