Fake WhatsApp/Instagram/Tinder companion-app installer execution

Arnold Chan@slaz

•updated Sep 4, 2026•1•0•1

This rule detects the execution of processes or network connections that impersonate 'WhatsApp' or 'Instagram' companion applications. It identifies specific file names and process command lines that mimic these applications, often associated with browser-launched or malicious payloads, and monitors for associated network traffic directed toward suspicious endpoints like herokuapp domains.