Proxy Web Requests for Flash Player Installer from Unofficial Locations

Flags proxy downloads for Flash Player installer paths when the request host is not ending in .adobe.com.

FreeReviewedSigma · High · v2

Category: proxy
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2017-10-25
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Defense Evasion

Recon
Resource Dev
Initial Access
- T1189Drive-by Compromise
Execution
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
- T1036.005Match Legitimate Resource Name or Location
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags proxy HTTP requests whose URI indicates downloading or installing Flash Player components, specifically matching paths like /flash_install.php and an .exe installer ending /install_flash_player.exe. Attackers may use unofficial or masquerading locations to deliver malicious installers under the guise of a legitimate update. It relies on proxy telemetry, including the requested URI and the client-facing host (cs-host), to identify traffic not ending in .adobe.com.

Reporting behind it

Related detections9 linkedT1204.002 — drag to rearrange

Suspicious Search-ms URI Handler Abuse to Remote Share

Suspicious macOS Installer Invocation Spawned via Zoom Opener Helper (via process_creation)

Malicious Lunar Spider Loader Execution via rundll32 (via process_creation)

Suspicious Loading of Masqueraded EndpointDlp.dll Backdoor

Suspicious svchost.exe Execution from Public Directory (via process_creation)

Suspicious Hidden PowerShell Web Download via ClickFix Tactic

Suspicious Process Masquerading as apached via GobRAT Bulbature Implant

Suspicious HijackLoader Component Execution via ClearFake

Malicious Silent AteraAgent RMM Installation via IntegratorLogin

Proxy Web Requests for Flash Player Installer from Unofficial Locations

Pivot detection · T1204.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

proxy-activity-flash-player-update-download-from-non-adobe-host-4922a5dd

title: Proxy Web Requests for Flash Player Installer from Unofficial Locations
id: 8e4233e3-13da-4ac3-afe6-e6d38ddc3e31
status: test
description: This rule flags proxy HTTP requests whose URI indicates downloading or installing Flash Player components, specifically matching paths like /flash_install.php and an .exe installer ending /install_flash_player.exe. Attackers may use unofficial or masquerading locations to deliver malicious installers under the guise of a legitimate update. It relies on proxy telemetry, including the requested URI and the client-facing host (cs-host), to identify traffic not ending in .adobe.com.
references:
  - https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_susp_flash_download_loc.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-10-25
modified: 2022-08-08
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1189
  - attack.execution
  - attack.t1204.002
  - attack.t1036.005
logsource:
  category: proxy
detection:
  selection:
    - c-uri|contains: /flash_install.php
    - c-uri|endswith: /install_flash_player.exe
  filter:
    cs-host|endswith: .adobe.com
  condition: selection and not filter
falsepositives:
  - Unknown flash download locations
level: high
license: DRL-1.1
related:
  - id: 4922a5dd-6743-4fc2-8e81-144374280997
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL