Actionable Threat Intel (IV) - YARA beyond files: extending rules to network IoCs

VirusTotal unveils YARA Netloc, extending YARA hunting to network entities (domains, URLs, IPs) via the vt.net attribute and Livehunt, with templates and community rules to accelerate adoption. The post showcases practical detections—monitoring domains distributing malware, flagging Cobalt Strike C2 by default SSL certificate thumbprint, and identifying Telegram-based exfiltration URLs linked to stealer activity—highlighting how to combine network signals with VirusTotal metadata for proactive infrastructure tracking.