Sunturai
Back to results
HighMicrosoft Sentinel analytics

Whisper Security - Co-Hosted Malware Cluster Detection

Identifies IP addresses that host multiple domains associated with malware. When an IP has more than 3 co-hosted domains and at least 3 of those domains are flagged as malware by Whisper threat intelligence, it…

Description

Identifies IP addresses that host multiple domains associated with malware. When an IP has more than 3 co-hosted domains and at least 3 of those domains are flagged as malware by Whisper threat intelligence, it strongly indicates compromised or adversary-controlled infrastructure.

Detection logic

Detection requirements

Platform
PRE

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
whispersecurityconnector
Log source service
whisperinfracontext_clwhisperthreatintel_cl

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice