Listed collection and testing domains
A tool call reaches a host on the rule domain list, or writes a URL for one into a script or configuration file.
Why it is risky
Section titled “Why it is risky”Collection endpoints and file-sharing services can receive secrets or other data. Several listed services also have ordinary debugging, security-testing, or messaging uses.
Example
Section titled “Example”An agent includes a production configuration file in a request to a public request-collection service.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule compares the hosts a call reaches with a static list, matching subdomains too. Hosts come from URLs in a command that runs or in a non-writing tool’s parameters, and from the arguments of network programs such as curl, wget, ssh and DNS lookups. A listed URL written into a script or configuration file still matches, one severity lower, because code that calls the host later is worth knowing about. The rule does not require proof that a request completed.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_SUPPLY_CHAIN_IOC_DOMAIN | supply_chain | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Review whether any request ran and what it sent. Check the specific account or endpoint, its ownership, and whether using it was authorized.
False positives
Section titled “False positives”An approved webhook test, security exercise, or ordinary use of a listed service may match, as can a script that names a listed service it never calls. Membership in this list does not make a service malicious.
False negatives
Section titled “False negatives”New domains, hidden traffic, list entries containing URL paths, and host names written without a URL scheme outside a network program’s arguments can be missed. A name such as transfer.sh, which looks like a file name, is read as a host only in its URL form. The current matcher compares hostnames, so path-qualified Discord webhook entries do not match as written.
Technical details
Section titled “Technical details”The rule ID uses IOC, meaning indicator of compromise. Interpret this finding as a listed-destination signal rather than verified threat intelligence about that particular endpoint.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.