Skip to content

Update link_large_guest_list_sus_link.yml - #5387

Merged
markmsublime merged 1 commit into
mainfrom
daniel.fn.ESC-25879.FN--Multi-service-abuse--Google-Calendar-invite-weaponized-to-deliver-Microsoft-Forms-phishing-lure
Sep 17, 2026
Merged

markmsublime merged 1 commit into
mainfrom
daniel.fn.ESC-25879.FN--Multi-service-abuse--Google-Calendar-invite-weaponized-to-deliver-Microsoft-Forms-phishing-lure

Conversation

@D-Bolton

@D-Bolton D-Bolton commented Sep 16, 2026

Copy link
Copy Markdown
Member

Description

Check final_dom.links for a suspicious link.

Associated samples

Associated hunts

@D-Bolton
D-Bolton marked this pull request as ready for review September 16, 2026 20:40
@D-Bolton
D-Bolton requested a review from a team September 16, 2026 20:40
@D-Bolton
D-Bolton requested a review from a team as a code owner September 16, 2026 20:40
github-actions Bot added a commit that referenced this pull request Sep 16, 2026
@github-actions github-actions Bot added test-rules:excluded:link_analysis Link analysis in rule, excluding from test rules hunting-required Hunts needed to validate rule efficacy labels Sep 16, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Test Rules Sync - Excluded

This PR contains rules that use ml.link_analysis, which is not supported in the test-rules environment.

The hunting-required label has been applied. These rules will need to be tested through alternative methods.

@D-Bolton

Copy link
Copy Markdown
Member Author

Hunts look good. Tagging for review.

@D-Bolton D-Bolton added the review-needed Indicates that a PR is waiting for review label Sep 17, 2026
@markmsublime markmsublime self-assigned this Sep 17, 2026

@markmsublime markmsublime left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

very nice telem!

@markmsublime
markmsublime added this pull request to the merge queue Sep 17, 2026
Merged via the queue into main with commit 2494958 Sep 17, 2026
7 checks passed
@markmsublime
markmsublime deleted the daniel.fn.ESC-25879.FN--Multi-service-abuse--Google-Calendar-invite-weaponized-to-deliver-Microsoft-Forms-phishing-lure branch September 17, 2026 14:14
github-actions Bot added a commit that referenced this pull request Sep 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

hunting-required Hunts needed to validate rule efficacy review-needed Indicates that a PR is waiting for review test-rules:excluded:link_analysis Link analysis in rule, excluding from test rules

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants