File Contacts IP Based on VirusTotal Relationships
This rule detects network connections initiated by a file whose SHA256 hash is known, via VirusTotal relationships, to contact a specific IP address. It correlates network connection events with VirusTotal intelligence to identify potentially malicious communication.
YARA-L
