Panther low experimental python

Cisco Umbrella Suspicious Domains

Monitor suspicious or known malicious domains

View Source

Detection Logic

DOMAINS_TO_MONITOR = {"photoscape.ch"}  # Sample malware domain


def rule(event):
    return any(domain in event.get("domain") for domain in DOMAINS_TO_MONITOR)


def title(event):
    return "Suspicious lookup to domain " + event.get("domain", "<UNKNOWN_DOMAIN>")

Field Validations

Loading…

Comments (0)

Loading comments...