Network and File Indicators of Compromise Detection

Arnold Chan@slaz

•updated Sep 21, 2026•0•0•3

This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.