diff --git a/KQL/preemptive-search-for-artoken-phaas-domain-lures.kql b/KQL/preemptive-search-for-artoken-phaas-domain-lures.kql
new file mode 100644
index 0000000..185bb3e
--- /dev/null
+++ b/KQL/preemptive-search-for-artoken-phaas-domain-lures.kql
@@ -0,0 +1,8 @@
+let ARTokenCFIOC=externaldata(Domain:string)
+[h'https://raw.githubusercontent.com/SlimKQL/Hunting-Queries-Detection-Rules/refs/heads/main/IOC/ARTokenIOC.csv']
+with (format='csv', ignoreFirstRecord=true)
+| project Domain;
+DeviceNetworkEvents
+| where Timestamp > ago(30d)
+| where ActionType == "ConnectionSuccess"
+| where RemoteUrl has_any(ARTokenCFIOC)
\ No newline at end of file