AT related malicious URL (e-docs.wormeld.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639158538078037919.ZDJlNmZmZjUtMDNlZS00NzRiLWI2MjQtYjEzMjUyYmM1MzhmODYxN2NkOTAtMDM1ZS00MDMxLWE1NzQtZjA0MjRmMGY2ZTQz&ui_locales=en-US&mkt=en-US&client-request-id=d7a661ce-d3b7-4f7e-a965-971c6914c01b&state=GapoXU5PEk3GThPdWaONEcumiZ4JeRb3161-bPblfTFvfkkNbJPxJH6DFCsZ0uuXviVh8U3MOYNFHLIOCrXEoncr315GwoTrS3gJHcikscW-YPYZmEhFa6-Mi4x7HocZRhoMeqv1tuUpNr6n5P5Bq1xPUdzykqmYzYS9DNlpgNpVVfChubABmwGsFznEVk0a_5FmtH_FzLLb4nuRdxVSy3Y9y0wJtqZPE16PQCBGKgLQfOScq8WFBi6jWIIjKvUK4XEhvMDN2RGMW3Gn7GLbZ219HN2Oxddm2sU4H7rvBysE0al3X2Z8YgtYeVnc7t4OvMKqk966aQfLtHhLyANaGyKK78TilJYtQ4EoS-aAWpWAZMVSbIDgs1AXcpWQrE0AKClLpKMqEPIPWdXqejmDmGrUqFN-_BZ_d00f7Jv_I3A&x-client-SKU=ID_NET8_0&x-client-ver=8.14.0.0)

SID: 6010115Rev: 1EnabledDerived1 views
History
Fileantiphishing.rules
CreatedJune 1, 2026
UpdatedJune 25, 2026
Classificationsocial-engineering
alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e-docs.wormeld.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639158538078037919.ZDJlNmZmZjUtMDNlZS00NzRiLWI2MjQtYjEzMjUyYmM1MzhmODYxN2NkOTAtMDM1ZS00MDMxLWE1NzQtZjA0MjRmMGY2ZTQz&ui_locales=en-US&mkt=en-US&client-request-id=d7a661ce-d3b7-4f7e-a965-971c6914c01b&state=GapoXU5PEk3GThPdWaONEcumiZ4JeRb3161-bPblfTFvfkkNbJPxJH6DFCsZ0uuXviVh8U3MOYNFHLIOCrXEoncr315GwoTrS3gJHcikscW-YPYZmEhFa6-Mi4x7HocZRhoMeqv1tuUpNr6n5P5Bq1xPUdzykqmYzYS9DNlpgNpVVfChubABmwGsFznEVk0a_5FmtH_FzLLb4nuRdxVSy3Y9y0wJtqZPE16PQCBGKgLQfOScq8WFBi6jWIIjKvUK4XEhvMDN2RGMW3Gn7GLbZ219HN2Oxddm2sU4H7rvBysE0al3X2Z8YgtYeVnc7t4OvMKqk966aQfLtHhLyANaGyKK78TilJYtQ4EoS-aAWpWAZMVSbIDgs1AXcpWQrE0AKClLpKMqEPIPWdXqejmDmGrUqFN-_BZ_d00f7Jv_I3A&x-client-SKU=ID_NET8_0&x-client-ver=8.14.0.0)"; flow:established,to_server; http.uri; content:"/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639158538078037919.ZDJlNmZmZjUtMDNlZS00NzRiLWI2MjQtYjEzMjUyYmM1MzhmODYxN2NkOTAtMDM1ZS00MDMxLWE1NzQtZjA0MjRmMGY2ZTQz&ui_locales=en-US&mkt=en-US&client-request-id=d7a661ce-d3b7-4f7e-a965-971c6914c01b&state=GapoXU5PEk3GThPdWaONEcumiZ4JeRb3161-bPblfTFvfkkNbJPxJH6DFCsZ0uuXviVh8U3MOYNFHLIOCrXEoncr315GwoTrS3gJHcikscW-YPYZmEhFa6-Mi4x7HocZRhoMeqv1tuUpNr6n5P5Bq1xPUdzykqmYzYS9DNlpgNpVVfChubABmwGsFznEVk0a_5FmtH_FzLLb4nuRdxVSy3Y9y0wJtqZPE16PQCBGKgLQfOScq8WFBi6jWIIjKvUK4XEhvMDN2RGMW3Gn7GLbZ219HN2Oxddm2sU4H7rvBysE0al3X2Z8YgtYeVnc7t4OvMKqk966aQfLtHhLyANaGyKK78TilJYtQ4EoS-aAWpWAZMVSbIDgs1AXcpWQrE0AKClLpKMqEPIPWdXqejmDmGrUqFN-_BZ_d00f7Jv_I3A&x-client-SKU=ID_NET8_0&x-client-ver=8.14.0.0"; startswith; fast_pattern; http.host; content:"e-docs.wormeld.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010115; classtype:social-engineering; sid:6010115; rev:1; metadata:signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;)

References

urlopenphish.com
urljulioliraup.github.io/AT/signature.html?sid=6010115

Metadata

signature severityMajor
created et2026_06_01
updated et2026_06_25

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!