Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

CYFIRMA - Attack Surface - Malicious Domain/IP Reputation Medium Rule

This alert is raised when CYFIRMA detects a critical reputation score for an IP address linked to your infrastructure. The IP has been previously associated with hacking activity and web application attacks. Denied outbound traffic to a foreign country from a known Microsoft data center IP suggests potential misuse or compromise of cloud infrastructure.

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source product: cyfirmaattacksurfacealertsconnector
Log source service: cyfirmaasdomainipreputationalerts_cl

What the source says

Tagged by the source as

CommandAndControlDefenseEvasionExfiltrationImpactInitialAccessReconnaissance

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.