Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Infra-VishingHelpdeskDomains.
Upgrade to ProDetect Impersonation Domains Acquired to Support Voice Phishing Helpdesk Social Engineering in Elastic Security
Ahead of a voice-phishing (vishing) campaign, actors such as Scattered Spider register a small cluster of domains that impersonate the target organization's IT helpdesk, SSO portal, or MFA self-service enrollment page (e.g., victimcorp-helpdesk[.]com, victimcorp-sso-verify[.]com, victimcorp-okta[.]net). These domains are stood up shortly before the actor calls or SMS-messages an employee — typically posing as IT support — and directs them to the lookalike page to 'verify their identity' or 're-enroll MFA,' harvesting credentials and a live MFA/push-approval in the process. Because the domain is freshly registered specifically for this operation, it has no browsing history in the target environment prior to the campaign, making the very first DNS query or HTTP request to it a high-value signal. Detection focuses on three pillars: (1) DNS/HTTP traffic to domains combining the organization's brand name with helpdesk/SSO/MFA-themed keywords, (2) first-time-ever resolution of such a domain within the environment (no prior 30-day history), and (3) close temporal correlation between a phone-based social-engineering contact recorded in the ticketing/telephony system and a subsequent authentication event or password/MFA reset for the same user.
MITRE ATT&CK
- Tactic
- Resource Development
Elastic Detection Query
sequence by client.ip with maxspan=5m
[
dns where event.type == "connection" and
dns.question.name : ("*victimcorp*helpdesk*", "*victimcorp*sso*", "*victimcorp*mfa*", "*victimcorp*verify*")
]
[
network where network.protocol == "http" and
http.request.method == "POST"
]Sequence-based Elastic EQL detection correlating a DNS resolution of a brand+helpdesk-keyword lookalike domain with a subsequent HTTP POST from the same client within 5 minutes — the DNS-resolve-then-submit-credentials pattern generated when a vishing target navigates to and interacts with an impersonation portal.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate internal helpdesk/SSO portals matching the keyword pattern that also receive form POSTs during normal use
- Authorized phishing-simulation platforms exercising the same DNS-then-POST pattern for training
- Automated form-fill testing/QA tooling against a legitimately co-branded vendor portal
Other platforms for THREAT-Infra-VishingHelpdeskDomains
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1DNS Query to Brand-Plus-Helpdesk-Keyword Lookalike Domain
Expected signal: Sysmon Event ID 22: DNS Query event with QueryName='victimcorp-helpdesk-verify.com'. The query will likely NXDOMAIN but the DNS attempt is logged regardless.
- Test 2First-Ever Resolution of SSO-Themed Lookalike Domain
Expected signal: Sysmon Event ID 22: QueryName='victimcorp-sso-mfa-reset.net' with no prior resolution history for this exact name in the environment's DNS logs.
- Test 3Simulated Ticketing-System MFA Reset Correlated to a Risk Event
Expected signal: A synthetic ticketing-audit JSON line simulating an MFAMethodAdded action for [email protected] — in a real environment this would be ingested into the SIEM's ServiceDeskAudit_CL-equivalent index.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Infra-VishingHelpdeskDomains — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month