File Contacts Domain Based on VirusTotal Relationships
This rule detects when a known malicious file, identified by its SHA256 hash through VirusTotal relationships, attempts to contact a domain that VirusTotal also associates with that file. It correlates DNS query events with VirusTotal intelligence to identify suspicious network communications originating from potentially compromised systems.
YARA-L
