detection.wiki

Detection rules › Sigma

Ursnif Malware C2 URL Pattern

Status
stable
Severity
critical
Log source
category proxy
Author
Thomas Patzke
Source
github.com/SigmaHQ/sigma

Detects Ursnif C2 traffic.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1566.001 Phishing: Spearphishing Attachment
ExecutionT1204.002 User Execution: Malicious File
Command & ControlT1071.001 Application Layer Protocol: Web Protocols

Rule body yaml

title: Ursnif Malware C2 URL Pattern
id: 932ac737-33ca-4afd-9869-0d48b391fcc9
status: stable
description: Detects Ursnif C2 traffic.
references:
    - https://www.fortinet.com/blog/threat-research/ursnif-variant-spreading-word-document.html
author: Thomas Patzke
date: 2019-12-19
modified: 2021-08-09
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.command-and-control
    - attack.t1071.001
    - detection.emerging-threats
logsource:
    category: proxy
detection:
    b64encoding:
        c-uri|contains:
            - '_2f'
            - '_2b'
    urlpatterns:
        c-uri|contains|all:
            - '.avi'
            - '/images/'
    condition: b64encoding and urlpatterns
falsepositives:
    - Unknown
level: critical

Stages and Predicates

Stage 0: condition

b64encoding and urlpatterns

Stage 1: b64encoding

b64encoding:
    c-uri|contains:
        - '_2f'
        - '_2b'

Stage 2: urlpatterns

urlpatterns:
    c-uri|contains|all:
        - '.avi'
        - '/images/'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
c-urimatch
  • .avi
  • /images/
  • _2b
  • _2f