Microsoft Tech Support Kit d94c3cf

Detects a Microsoft tech support kit targeting Japanese speaking users. Using the same name for the warning audio file as well as the same class name attribute for the banner elements.

References

IOK Rule (edit) 

title: Microsoft Tech Support Kit d94c3cf
description: |
    Detects a Microsoft tech support kit targeting 
    Japanese speaking users. Using the same name for the warning
    audio file as well as the same class `name` attribute for the 
    banner elements.
    
references:
    - https://urlscan.io/result/d94c3cf3-223e-4460-b29b-9d50fdb2caad
    - https://urlscan.io/result/3f9eb89b-f1a8-4bf1-9c2a-604c0efff9ac


detection:

    audioFile:
      requests|contains: 'takashi.mp3'

    bannerElement:
      html|contains|all: 
        - 'banner_chat_tel'
        - 'banner_chat_contact'
        - 'banner_chat_label'
   
    condition: audioFile and bannerElement

tags:
  - target.microsoft
  - target_country.japan