Trojanized Freeware Installer Download from Typosquatted Domain
This rule identifies suspicious activity involving potential trojanized software installers and connections to known typosquatting or malicious domains. It flags processes spawned by common web browsers that match known malicious installer filenames and monitors for DNS queries to domains frequently associated with software supply chain or distribution-based malicious activity.
Cortex XDR
