{"id":"00d0b5ab-1f55-4120-8e83-487c0a7baf19","title":"Download From Suspicious TLD - Blacklist","description":"Detects download of certain file types from hosts in suspicious TLDs","author":"Florian Roth (Nextron Systems)","status":"test","level":"low","date":"2017-11-07","modified":"2023-05-18","tags":["attack.initial-access","attack.t1566","attack.execution","attack.t1203","attack.t1204.002"],"technique_ids":["T1203","T1204.002","T1566"],"logsource":{"category":"proxy"},"falsepositives":["All kinds of software downloads"],"references":["https://www.symantec.com/connect/blogs/shady-tld-research-gdn-and-our-2016-wrap","https://promos.mcafee.com/en-US/PDF/MTMW_Report.pdf","https://www.spamhaus.org/statistics/tlds/","https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/"],"source_path":"rules/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml","source_sha256":"3f331d3bf8ea9d4a6e218b01379e033d39e3f5e0b4f873b4a92d0103eabac22a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Download From Suspicious TLD - Blacklist\nid: 00d0b5ab-1f55-4120-8e83-487c0a7baf19\nrelated:\n    - id: b5de2919-b74a-4805-91a7-5049accbaefe\n      type: similar\nstatus: test\ndescription: Detects download of certain file types from hosts in suspicious TLDs\nreferences:\n    - https://www.symantec.com/connect/blogs/shady-tld-research-gdn-and-our-2016-wrap\n    - https://promos.mcafee.com/en-US/PDF/MTMW_Report.pdf\n    - https://www.spamhaus.org/statistics/tlds/\n    - https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-11-07\nmodified: 2023-05-18\ntags:\n    - attack.initial-access\n    - attack.t1566\n    - attack.execution\n    - attack.t1203\n    - attack.t1204.002\nlogsource:\n    category: proxy\ndetection:\n    selection:\n        c-uri-extension:\n            - 'exe'\n            - 'vbs'\n            - 'bat'\n            - 'rar'\n            - 'ps1'\n            - 'doc'\n            - 'docm'\n            - 'xls'\n            - 'xlsm'\n            - 'pptm'\n            - 'rtf'\n            - 'hta'\n            - 'dll'\n            - 'ws'\n            - 'wsf'\n            - 'sct'\n            - 'zip'\n            # If you want to add more extensions - see https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/\n        cs-host|endswith:\n            # Symantec / Chris Larsen analysis\n            - '.country'\n            - '.stream'\n            - '.gdn'\n            - '.mom'\n            - '.xin'\n            - '.kim'\n            - '.men'\n            - '.loan'\n            - '.download'\n            - '.racing'\n            - '.online'\n            - '.science'\n            - '.ren'\n            - '.gb'\n            - '.win'\n            - '.top'\n            - '.review'\n            - '.vip'\n            - '.party'\n            - '.tech'\n            - '.xyz'\n            - '.date'\n            - '.faith'\n            - '.zip'\n            - '.cricket'\n            - '.space'\n            # McAfee report\n            - '.info'\n            - '.vn'\n            - '.cm'\n            - '.am'\n            - '.cc'\n            - '.asia'\n            - '.ws'\n            - '.tk'\n            - '.biz'\n            - '.su'\n            - '.st'\n            - '.ro'\n            - '.ge'\n            - '.ms'\n            - '.pk'\n            - '.nu'\n            - '.me'\n            - '.ph'\n            - '.to'\n            - '.tt'\n            - '.name'\n            - '.tv'\n            - '.kz'\n            - '.tc'\n            - '.mobi'\n            # Spamhaus\n            - '.study'\n            - '.click'\n            - '.link'\n            - '.trade'\n            - '.accountant'\n            # Spamhaus 2018 https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/\n            - '.cf'\n            - '.gq'\n            - '.ml'\n            - '.ga'\n            # Custom\n            - '.pw'\n    condition: selection\nfalsepositives:\n    - All kinds of software downloads\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","page":"techniques/enterprise/T1203/"},{"key":"enterprise/T1204.002","id":"T1204.002","name":"Malicious File","page":"techniques/enterprise/T1204.002/"},{"key":"enterprise/T1566","id":"T1566","name":"Phishing","page":"techniques/enterprise/T1566/"}],"data_path":"data/detection-rules/00d0b5ab-1f55-4120-8e83-487c0a7baf19.json","kind":"sigma"}