AT related malicious URL (login.sharesdashboards.info/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639146735482145274.ZGEyNDMzZjktNzk3Mi00MzE5LTliNWEtY2JmZjY5NTU2ZDNiOTQ4M2YzOTUtYzFlNS00Mzc1LWJjMGYtMmI3MzIyZjI1YjM0&ui_locales=en-US&mkt=en-US&client-request-id=e73901af-cf73-4bc8-a1cf-75414cac0f85&state=QmJCmUQidVFG6rVZdq62gKWzjFA6uqU3kaWsJe775M-ZOJ1g35a59WFzNhZXGqOsYV667IPNDOjZ3wJwC6ntCqyprYhLbx-bpW9Gc5e6wRoS4bwGVJFqdVI4OgRK5vNf0P5SYP5J4BTXYKHE7LVqRGayY9hg0NBLLREy4zXFPkQ-BIq1zznwMOF25GtmnAQu6zDPat_t9OSKVFaAH4ycZTyiDYhB20vYWjAFyZ76l-8AtOwyt8CADT6J9Bvfar-viKVLrm01vNseUiC1nOmybK5lCN_ECPWKDi9NZZ8R-ntWMUtk5cQ5m1yftBSURgnoUVOR2vNAEU14ykIPxVXthisD76WYM89gvfER72-UQugVqwTvQ5uvc5tHGIgR9XExv3G-JsNJf0PiE25x-fpBliVPz9HP8Kb3uJ9APrJ80_o&x-client-SKU=ID_NET8_0&x-client-ver=8.14.0.0)

SID: 6002636Rev: 10 views
Sourcejulioliraup/antiphishing
CreatedMay 22, 2026
UpdatedMay 22, 2026
Classificationsocial-engineering
alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.sharesdashboards.info/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639146735482145274.ZGEyNDMzZjktNzk3Mi00MzE5LTliNWEtY2JmZjY5NTU2ZDNiOTQ4M2YzOTUtYzFlNS00Mzc1LWJjMGYtMmI3MzIyZjI1YjM0&ui_locales=en-US&mkt=en-US&client-request-id=e73901af-cf73-4bc8-a1cf-75414cac0f85&state=QmJCmUQidVFG6rVZdq62gKWzjFA6uqU3kaWsJe775M-ZOJ1g35a59WFzNhZXGqOsYV667IPNDOjZ3wJwC6ntCqyprYhLbx-bpW9Gc5e6wRoS4bwGVJFqdVI4OgRK5vNf0P5SYP5J4BTXYKHE7LVqRGayY9hg0NBLLREy4zXFPkQ-BIq1zznwMOF25GtmnAQu6zDPat_t9OSKVFaAH4ycZTyiDYhB20vYWjAFyZ76l-8AtOwyt8CADT6J9Bvfar-viKVLrm01vNseUiC1nOmybK5lCN_ECPWKDi9NZZ8R-ntWMUtk5cQ5m1yftBSURgnoUVOR2vNAEU14ykIPxVXthisD76WYM89gvfER72-UQugVqwTvQ5uvc5tHGIgR9XExv3G-JsNJf0PiE25x-fpBliVPz9HP8Kb3uJ9APrJ80_o&x-client-SKU=ID_NET8_0&x-client-ver=8.14.0.0)"; flow:established,to_server; http.uri; content:"/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639146735482145274.ZGEyNDMzZjktNzk3Mi00MzE5LTliNWEtY2JmZjY5NTU2ZDNiOTQ4M2YzOTUtYzFlNS00Mzc1LWJjMGYtMmI3MzIyZjI1YjM0&ui_locales=en-US&mkt=en-US&client-request-id=e73901af-cf73-4bc8-a1cf-75414cac0f85&state=QmJCmUQidVFG6rVZdq62gKWzjFA6uqU3kaWsJe775M-ZOJ1g35a59WFzNhZXGqOsYV667IPNDOjZ3wJwC6ntCqyprYhLbx-bpW9Gc5e6wRoS4bwGVJFqdVI4OgRK5vNf0P5SYP5J4BTXYKHE7LVqRGayY9hg0NBLLREy4zXFPkQ-BIq1zznwMOF25GtmnAQu6zDPat_t9OSKVFaAH4ycZTyiDYhB20vYWjAFyZ76l-8AtOwyt8CADT6J9Bvfar-viKVLrm01vNseUiC1nOmybK5lCN_ECPWKDi9NZZ8R-ntWMUtk5cQ5m1yftBSURgnoUVOR2vNAEU14ykIPxVXthisD76WYM89gvfER72-UQugVqwTvQ5uvc5tHGIgR9XExv3G-JsNJf0PiE25x-fpBliVPz9HP8Kb3uJ9APrJ80_o&x-client-SKU=ID_NET8_0&x-client-ver=8.14.0.0"; startswith; fast_pattern; http.host; content:"login.sharesdashboards.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/ET/signature.html?sid=6002636; classtype:social-engineering; sid:6002636; rev:1; metadata:signature_severity Major, created_et 2026_05_18;)

References

urlopenphish.com
urljulioliraup.github.io/ET/signature.html?sid=6002636

Metadata

signature severityMajor
created et2026_05_18

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!