Raw Paste Service Access

Status: test
Severity: high
Log source: category proxy
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

Known false positives

User activity (e.g. developer that shared and copied code snippets and used the raw link instead of just copy & paste)

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1071.001` Application Layer Protocol: Web Protocols `T1102.001` Web Service: Dead Drop Resolver `T1102.003` Web Service: One-Way Communication

Rule body

title: Raw Paste Service Access
id: 5468045b-4fcc-4d1a-973c-c9c9578edacb
status: test
description: Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form
references:
    - https://www.virustotal.com/gui/domain/paste.ee/relations
author: Florian Roth (Nextron Systems)
date: 2019-12-05
modified: 2023-01-19
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1102.001
    - attack.t1102.003
logsource:
    category: proxy
detection:
    selection:
        c-uri|contains:
            - '.paste.ee/r/'
            - '.pastebin.com/raw/'
            - '.hastebin.com/raw/'
            - '.ghostbin.co/paste/*/raw/'
            - 'pastetext.net/'
            - 'pastebin.pl/'
            - 'paste.ee/'
    condition: selection
falsepositives:
    - User activity (e.g. developer that shared and copied code snippets and used the raw link instead of just copy & paste)
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    c-uri|contains:
        - '.paste.ee/r/'
        - '.pastebin.com/raw/'
        - '.hastebin.com/raw/'
        - '.ghostbin.co/paste/*/raw/'
        - 'pastetext.net/'
        - 'pastebin.pl/'
        - 'paste.ee/'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`c-uri`	match	`.ghostbin.co/paste/*/raw/` `.hastebin.com/raw/` `.paste.ee/r/` `.pastebin.com/raw/` `paste.ee/` `pastebin.pl/` `pastetext.net/`	`field:"c-uri" kind:match`