add Roblox phishing 🚀

indicators/roblox-phishing.yml

@@ -0,0 +1,35 @@
+title: Roblox phishing
+description: |
+    Detects Roblox phishing sites using a roblox body id and cdn.
+    Usually at /controlPage/create you can create a "Beaming link".
+    Often spread trough discord.
+
+level: likely_malicious
+
+references:
+  - https://www.youtube.com/watch?v=lUL2vgyhsw4
+  - https://urlscan.io/result/c716b820-174e-4211-9c09-4663b4a7e47d/
+  - https://urlscan.io/result/c716b820-174e-4211-9c09-4663b4a7e47d/
+  - https://urlscan.io/result/e76d7a2f-3e6d-455e-8da8-1a94ea6c222f/
+  - https://urlscan.io/result/f9ccb8a3-624b-4cb1-b237-36dd81cef6e3/
+  - https://urlscan.io/result/1a62439f-de11-4ee6-a0ed-9c482c0c1906/
+
+detection:
+
+    realdomain:
+        hostname|endswith:
+            - .roblox.com
+            - .rbxcdn.com
+
+    rbxbodyid:
+        dom|contains: body id="rbx-body"
+
+    rbxcdn:
+        dom|contains: rbxcdn
+
+
+    condition: rbxcdn and rbxbodyid and not realdomain
+
+tags:
+    - kit
+    - target.roblox