Outbound Network Connection to Threat Intelligence IP
This rule detects outbound network connections to IP addresses that are identified as Indicators of Compromise (IOCs) within a threat intelligence platform, specifically MISP. It filters out connections to RFC1918 private IP ranges to reduce false positives. The rule correlates network connection events with ingested MISP data to identify malicious communication.
YARA-L
