Network Connection to Malicious Domains with Suspicious Paths

nomit vyas@xoxo

•updated Jun 21, 2026•0•0•4

This rule detects network connections from endpoints to a list of known malicious domains. The detection is further refined by looking for specific URL paths such as '/wlc/', '/load/', or 'success/', which are commonly associated with command and control (C2) communication or data exfiltration activities by malware. This indicates potential compromise and active communication with adversary infrastructure.