detection.wiki

Detection rules › Sigma

Download From Suspicious TLD - Whitelist

Status
test
Severity
low
Log source
category proxy
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects executable downloads from suspicious remote systems

Known false positives

  • All kind of software downloads

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Execution

Rule body

title: Download From Suspicious TLD - Whitelist
id: b5de2919-b74a-4805-91a7-5049accbaefe
related:
    - id: 00d0b5ab-1f55-4120-8e83-487c0a7baf19
      type: similar
status: test
description: Detects executable downloads from suspicious remote systems
references:
    - Internal Research
author: Florian Roth (Nextron Systems)
date: 2017-03-13
modified: 2023-05-18
tags:
    - attack.initial-access
    - attack.t1566
    - attack.execution
    - attack.t1203
    - attack.t1204.002
logsource:
    category: proxy
detection:
    selection:
        c-uri-extension:
            - 'exe'
            - 'vbs'
            - 'bat'
            - 'rar'
            - 'ps1'
            - 'doc'
            - 'docm'
            - 'xls'
            - 'xlsm'
            - 'pptm'
            - 'rtf'
            - 'hta'
            - 'dll'
            - 'ws'
            - 'wsf'
            - 'sct'
            - 'zip'
            # If you want to add more extensions - see https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/
    filter:
        cs-host|endswith:
            - '.com'
            - '.org'
            - '.net'
            - '.edu'
            - '.gov'
            - '.uk'
            - '.ca'
            - '.de'
            - '.jp'
            - '.fr'
            - '.au'
            - '.us'
            - '.ch'
            - '.it'
            - '.nl'
            - '.se'
            - '.no'
            - '.es'
            # Extend this list as needed
    condition: selection and not filter
falsepositives:
    - All kind of software downloads
level: low

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
    c-uri-extension:
        - 'exe'
        - 'vbs'
        - 'bat'
        - 'rar'
        - 'ps1'
        - 'doc'
        - 'docm'
        - 'xls'
        - 'xlsm'
        - 'pptm'
        - 'rtf'
        - 'hta'
        - 'dll'
        - 'ws'
        - 'wsf'
        - 'sct'
        - 'zip'

Stage 2: not filter

filter:
    cs-host|endswith:
        - '.com'
        - '.org'
        - '.net'
        - '.edu'
        - '.gov'
        - '.uk'
        - '.ca'
        - '.de'
        - '.jp'
        - '.fr'
        - '.au'
        - '.us'
        - '.ch'
        - '.it'
        - '.nl'
        - '.se'
        - '.no'
        - '.es'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
cs-hostends_with.auexcludes:cs-host field:"cs-host" value:".au"
cs-hostends_with.caexcludes:cs-host field:"cs-host" value:".ca"
cs-hostends_with.chexcludes:cs-host field:"cs-host" value:".ch"
cs-hostends_with.comexcludes:cs-host field:"cs-host" value:".com"
cs-hostends_with.deexcludes:cs-host field:"cs-host" value:".de"
cs-hostends_with.eduexcludes:cs-host field:"cs-host" value:".edu"
cs-hostends_with.esexcludes:cs-host field:"cs-host" value:".es"
cs-hostends_with.frexcludes:cs-host field:"cs-host" value:".fr"
cs-hostends_with.govexcludes:cs-host field:"cs-host" value:".gov"
cs-hostends_with.itexcludes:cs-host field:"cs-host" value:".it"
cs-hostends_with.jpexcludes:cs-host field:"cs-host" value:".jp"
cs-hostends_with.netexcludes:cs-host field:"cs-host" value:".net"
cs-hostends_with.nlexcludes:cs-host field:"cs-host" value:".nl"
cs-hostends_with.noexcludes:cs-host field:"cs-host" value:".no"
cs-hostends_with.orgexcludes:cs-host field:"cs-host" value:".org"
cs-hostends_with.seexcludes:cs-host field:"cs-host" value:".se"
cs-hostends_with.ukexcludes:cs-host field:"cs-host" value:".uk"
cs-hostends_with.usexcludes:cs-host field:"cs-host" value:".us"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
c-uri-extensioneq
  • bat
  • dll
  • doc
  • docm
  • exe
  • hta
  • pptm
  • ps1
  • rar
  • rtf
  • sct
  • vbs
  • ws
  • wsf
  • xls
  • xlsm
  • zip
field:"c-uri-extension" kind:eq