Proxy Activity: Flash Player Update Download From Non-Adobe Host

title: "Proxy Activity: Flash Player Update Download From Non-Adobe Host"
id: 8e4233e3-13da-4ac3-afe6-e6d38ddc3e31
status: test
description: This rule identifies proxy requests attempting to download Flash Player installer components by matching specific URI paths associated with flash installation. It matters because attackers can use the same update/download locations and filenames to stage initial access or execution while blending in as a software update. The detection relies on proxy telemetry fields for the requested URI and the client-requested host to exclude traffic ending with .adobe.com.
references:
  - https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_susp_flash_download_loc.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-10-25
modified: 2022-08-08
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1189
  - attack.execution
  - attack.t1204.002
  - attack.t1036.005
logsource:
  category: proxy
detection:
  selection:
    - c-uri|contains: /flash_install.php
    - c-uri|endswith: /install_flash_player.exe
  filter:
    cs-host|endswith: .adobe.com
  condition: selection and not filter
falsepositives:
  - Unknown flash download locations
level: high
license: DRL-1.1
related:
  - id: 4922a5dd-6743-4fc2-8e81-144374280997
    type: derived