KREMLIN lookalike domain rotation reusing payload GUID/URI hash

Ankit Mehta@Secvyn

•updated Sep 16, 2026•0•0•1

This rule detects network connections to a list of known lookalike domains or specific indicators (a payload GUID and a URI hash) associated with suspicious activity. It uses a time-based aggregation to identify hosts interacting with multiple suspicious domains or both specific payload indicators, suggesting potential C2 activity or a targeted phishing/malware delivery campaign.