Network HTTP Low Prevalence Domain Access
This rule detects HTTP web access to domains that exhibit low prevalence within the monitored environment. It specifically filters out internal RFC 1918 IP addresses and ensures that only valid Fully Qualified Domain Names (FQDNs) are considered. The prevalence is determined by a rolling maximum count of unique days a domain has been observed, with alerts triggering for domains seen 3 or fewer times. The risk score is incremented based on how low the prevalence is, with the lowest prevalence (1 day) resulting in the highest risk score.
YARA-L
