Proxy Downloads Containing /pwndrop/ (PwnDrp Web Server)

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags proxy traffic where the requested URI contains the path '/pwndrop/'. It targets access to web server endpoints associated with PwnDrp, which are commonly used to serve payloads or command-and-control artifacts. The detection relies on proxy telemetry that records the client-requested URI (c-uri).

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Proxy access to raw paste endpoints on paste.ee and Pastebin-style services

Malicious axios NPM Supply Chain C2 Domain Resolution

Suspicious Reverse Shell via Dev TCP or Netcat

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Malicious Renamed Python Interpreter Executing nvidia.py RAT

Proxy Downloads Containing /pwndrop/ (PwnDrp Web Server)

Pivot detection · T1071.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

proxy-activity-download-requests-to-pwndrop-pwndrp-web-server-2b1ee7e4

title: Proxy Downloads Containing /pwndrop/ (PwnDrp Web Server)
id: 55e46ea8-5e85-429b-81a7-1676c794f621
status: test
description: This rule flags proxy traffic where the requested URI contains the path '/pwndrop/'. It targets access to web server endpoints associated with PwnDrp, which are commonly used to serve payloads or command-and-control artifacts. The detection relies on proxy telemetry that records the client-requested URI (c-uri).
references:
  - https://breakdev.org/pwndrop/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_pwndrop.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-04-15
modified: 2021-11-27
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1102.001
  - attack.t1102.003
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: /pwndrop/
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL