Network/DNS activity to known phishing domains/IPs (2026-09-21)

Ankit Mehta@Secvyn

•updated Sep 21, 2026•0•0•3

This rule monitors DeviceNetworkEvents and DnsEvents for connections to known malicious domains and IP addresses associated with phishing campaigns. It alerts on any network communication or DNS resolution attempt targeting these indicators, providing visibility into potential user interaction with phishing infrastructure.