WHOIS DNS Query To Typosquatting Domain
This rule detects DNS queries for domains that contain a specific string (e.g., a company name) and are not registered with an approved domain registrar. It leverages WHOIS data to identify potentially malicious typosquatting domains that have been recently registered or observed. The rule specifically looks for DNS queries where the domain name matches a defined pattern (e.g., 'threatpunter') and the WHOIS information indicates a registrar other than the approved one ('MarkMonitor Inc.'). Additionally, it checks if the domain was first seen in the environment within the last 30 days, indicating a new or suspicious registration.
YARA-L
