Vulnerability Intelligence Purchase Platform Access
This rule detects network connections to known vulnerability intelligence purchase platforms (zerodium.com, crowdfense.com, exodus.gl). These platforms are often used by threat actors to acquire zero-day exploits or other vulnerabilities. Accessing these sites could indicate an organization or individual is attempting to purchase or sell such intelligence, which can be a precursor to malicious activity or a violation of organizational policy.
Suricata
