Facebook Phishing Kit 54b8f7e

Detects a Facebook phishing kit.

References

IOK Rule (edit) 

title: Facebook Phishing Kit 54b8f7e
description: |
    Detects a Facebook phishing kit.
    
references:
   - https://urlscan.io/result/d45ebbf2-ecf0-4a83-a908-7c7d08522d1c
   
detection:

  formExfil: 
    html|contains: 'rek.php'

  styleSheets:
    requests|contains|all:
      - 'becak.css'
      - 'galon.css'

  logoImage:
    requests|contains: 'https://i.ibb.co/T19ghq4/789.png'

  condition: formExfil and styleSheets and logoImage

tags:
  - kit
  - target.facebook