Proxy Activity: Download Requests to /pwndrop/ (PwnDrp Web Server)

title: "Proxy Activity: Download Requests to /pwndrop/ (PwnDrp Web Server)"
id: 55e46ea8-5e85-429b-81a7-1676c794f621
status: test
description: This rule flags proxy requests whose URI contains the path segment '/pwndrop/', indicating access to web content associated with PwnDrp. Such activity can represent command-and-control related delivery, where attackers host tooling or payloads on a web server and retrieve it via HTTP/S. It relies on proxy telemetry containing request URIs and matches only when the specified substring appears in the requested path.
references:
  - https://breakdev.org/pwndrop/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_pwndrop.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-04-15
modified: 2021-11-27
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1102.001
  - attack.t1102.003
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: /pwndrop/
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e
    type: derived