For blue teams scanning endpoints or email gateways, here are the key IOCs (Indicators of Compromise) associated with PHBot lure scripts.
: You can set phBot to "Stop luring" if too many party members are dead or if there are too many giants in the training area to prevent a party wipe. Common Troubleshooting phbot lure script