Download From Suspicious TLD - Whitelist (via proxy)

title: Download From Suspicious TLD - Whitelist (via proxy)
id: 6813ce48-f507-50cc-bd16-3946a9bfaa19
status: stable
description: This rule detects executable downloads from anomalous remote systems
references:
    - https://attack.mitre.org/techniques/T1204/002/
    - https://attack.mitre.org/techniques/T1203/
    - https://attack.mitre.org/techniques/T1566/
    - Internal Research
author: Huntrule Team
date: 2026-05-31
tags:
    - attack.initial-access
    - attack.t1566
    - attack.execution
    - attack.t1203
    - attack.t1204.002
logsource:
    category: proxy
detection:
    selection:
        c-uri-extension:
            - 'exe'
            - 'vbs'
            - 'bat'
            - 'rar'
            - 'ps1'
            - 'doc'
            - 'docm'
            - 'xls'
            - 'xlsm'
            - 'pptm'
            - 'rtf'
            - 'hta'
            - 'dll'
            - 'ws'
            - 'wsf'
            - 'sct'
            - 'zip'
    filter:
        cs-host|endswith:
            - '.com'
            - '.org'
            - '.net'
            - '.edu'
            - '.gov'
            - '.uk'
            - '.ca'
            - '.de'
            - '.jp'
            - '.fr'
            - '.au'
            - '.us'
            - '.ch'
            - '.it'
            - '.nl'
            - '.se'
            - '.no'
            - '.es'
    condition: selection and not filter
falsepositives:
    - Unknown
level: low