Detections

Explore public detection logic contributed by the community across SIEM and rule languages.

1 detection

Correlates DNS/network requests to newly observed domains matching JWR's brand-plus-suffix generation pattern across .top/.cfd/.info/.cc TLDs, requiring multiple distinct hostnames sharing the same brand token within a short window to flag likely batch-registered phishing infrastructure.
avatar
Duo Tech@duotech
avatar
Detections.ai Community
3 months ago
003