PhaaS: Impact Solutions (Impact Vector Suite)

 1name: "PhaaS: Impact Solutions (Impact Vector Suite)"
 2description: |
 3  Identifies the use of the Impact Solutions PhaaS.
 4
 5  Impact Vector Suite is a full-spectrum payload delivery platform, engineered for stealth-optimized execution across all major deployment vectors.  
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  and (
11    (
12      length(attachments) >= 1
13      and any(attachments,
14              .size < 10000
15              and .file_extension == "htm"
16              and (
17                regex.icontains(file.parse_html(.).raw,
18                                "const (?:urlParts|fakeEvent|progressBar|segments)"
19                )
20                or any([file.parse_html(.).raw],
21                       strings.icontains(., "impact?")
22                       or strings.icontains(., "/impact")
23                )
24              )
25      )
26    )
27    or (
28      any(body.links,
29          (
30            strings.icontains(.href_url.url, "impact?")
31            or strings.icontains(.href_url.url, "/impact")
32          )
33          and (
34            strings.icontains(.href_url.url, ":8443")
35            or strings.icontains(.href_url.url, ":2087")
36          )
37      )
38    )
39  )  
40attack_types:
41  - "Credential Phishing"
42tactics_and_techniques:
43  - "Evasion"
44detection_methods:
45  - "Content analysis"
46id: "4d197faf-31bc-5f09-bf60-9f6a52f913a9"