feat: Add Evilginx 3.x AiTM detection rules (proxy + webserver)

[CyberLeakWatch]

Summary

Adds 4 new Sigma detection rules for the Evilginx 3.x Adversary-in-the-Middle (AiTM) phishing framework. These rules detect session cookie theft and credential injection patterns that currently have no Sigma detection coverage in the repository.

Rules Added

Rule	Location	Level	MITRE ATT&CK
evilginx_linkedin_cookie_exfiltration	rules/web/proxy_generic/	high	T1539, T1566.002
evilginx_microsoft_cookie_exfiltration	rules/web/proxy_generic/	high	T1539, T1566.002
evilginx_microsoft_kmsi_manipulation	rules/web/proxy_generic/	medium	T1539, T1556
evilginx_js_injection_pattern	rules/web/webserver_generic/	critical	T1566.002, T1059.007

Detection Coverage

• LinkedIn phishlet: Detects li_at session cookie exfiltration through non-LinkedIn proxy destinations
• Microsoft 365 phishlet: Detects ESTSAUTH, ESTSAUTHPERSISTENT, SDIDC, JSHP cookie theft targeting non-Microsoft destinations
• KMSI manipulation: Detects forced Keep Me Signed In parameter in /ppsecure/post.srf through non-Microsoft proxies (used to obtain persistent session cookies)
• JS injection: Detects Evilginx-specific JavaScript credential injection polling function (function lp(){}) and DOM manipulation patterns in webserver responses

Context

Evilginx 3.x is one of the most prevalent AiTM phishing frameworks targeting enterprise authentication. It bypasses MFA (TOTP/SMS/push) by proxying the real authentication flow. Despite its prevalence, there are currently no Evilginx-specific detection rules in the SigmaHQ repository.

References

• Evilginx repository
• Evilginx 3.0 release
• Microsoft AiTM phishing analysis
• MITRE ATT&CK: T1539, T1566.002, T1556, T1059.007

Checklist

• Rules follow SigmaHQ conventions (YAML format, UUID v4 IDs, ISO 8601 dates)
• Proper logsource categories (proxy, webserver)
• MITRE ATT&CK tags included
• False positive documentation included
• No duplicate rules in existing repository (verified via search)