Suspicious Network Connection to Known Malicious Domains

nomit vyas@xoxo

•updated Jun 22, 2026•0•0•12

This rule detects network connections or URL clicks to a list of known malicious domains often associated with phishing or malware distribution. The rule specifically looks for connections to these domains combined with certain URL paths, or direct URL clicks to these domains.