{"id":"4922a5dd-6743-4fc2-8e81-144374280997","title":"Flash Player Update from Suspicious Location","description":"Detects a flashplayer update from an unofficial location","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-10-25","modified":"2022-08-08","tags":["attack.initial-access","attack.stealth","attack.t1189","attack.execution","attack.t1204.002","attack.t1036.005"],"technique_ids":["T1036.005","T1189","T1204.002"],"logsource":{"category":"proxy"},"falsepositives":["Unknown flash download locations"],"references":["https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb"],"source_path":"rules/web/proxy_generic/proxy_susp_flash_download_loc.yml","source_sha256":"1614a83290c213089d9c4e16dd340cb4d1b99b60a407c09f2dc88caf8e258b67","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_susp_flash_download_loc.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Flash Player Update from Suspicious Location\nid: 4922a5dd-6743-4fc2-8e81-144374280997\nstatus: test\ndescription: Detects a flashplayer update from an unofficial location\nreferences:\n    - https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-10-25\nmodified: 2022-08-08\ntags:\n    - attack.initial-access\n    - attack.stealth\n    - attack.t1189\n    - attack.execution\n    - attack.t1204.002\n    - attack.t1036.005\nlogsource:\n    category: proxy\ndetection:\n    selection:\n        - c-uri|contains: '/flash_install.php'\n        - c-uri|endswith: '/install_flash_player.exe'\n    filter:\n        cs-host|endswith: '.adobe.com'\n    condition: selection and not filter\nfalsepositives:\n    - Unknown flash download locations\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.005","id":"T1036.005","name":"Match Legitimate Resource Name or Location","page":"techniques/enterprise/T1036.005/"},{"key":"enterprise/T1189","id":"T1189","name":"Drive-by Compromise","page":"techniques/enterprise/T1189/"},{"key":"enterprise/T1204.002","id":"T1204.002","name":"Malicious File","page":"techniques/enterprise/T1204.002/"}],"data_path":"data/detection-rules/4922a5dd-6743-4fc2-8e81-144374280997.json","kind":"sigma"}