Proxy Web Requests for Flash Player Installer from Unofficial Locations

Flags proxy downloads for Flash Player installer paths when the request host is not ending in .adobe.com.

FreeReviewedSigma · High · v2

Category: proxy
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2017-10-25
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Defense Evasion

Recon
Resource Dev
Initial Access
- T1189Drive-by Compromise
Execution
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
- T1036.005Match Legitimate Resource Name or Location
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags proxy HTTP requests whose URI indicates downloading or installing Flash Player components, specifically matching paths like /flash_install.php and an .exe installer ending /install_flash_player.exe. Attackers may use unofficial or masquerading locations to deliver malicious installers under the guise of a legitimate update. It relies on proxy telemetry, including the requested URI and the client-facing host (cs-host), to identify traffic not ending in .adobe.com.

Reporting behind it

Related detections9 linkedT1204.002 — drag to rearrange

Suspicious macOS Installer Invocation Spawned via Zoom Opener Helper (via process_creation)

Suspicious OneNote Spawning Script Interpreter (via process_creation)

Scheduled Task Masquerading as Microsoft Wininet Config

Suspicious vbc.exe Spawned by Installer Process

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

Suspicious NFe-Themed Brazilian Lure Executable Execution

Malicious Spoolsv Process Masquerading From Non-System Path (via process_creation)

Proxy Web Requests for Flash Player Installer from Unofficial Locations

Pivot detection · T1204.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

proxy-activity-flash-player-update-download-from-non-adobe-host-4922a5dd

title: Proxy Web Requests for Flash Player Installer from Unofficial Locations
id: 8e4233e3-13da-4ac3-afe6-e6d38ddc3e31
status: test
description: This rule flags proxy HTTP requests whose URI indicates downloading or installing Flash Player components, specifically matching paths like /flash_install.php and an .exe installer ending /install_flash_player.exe. Attackers may use unofficial or masquerading locations to deliver malicious installers under the guise of a legitimate update. It relies on proxy telemetry, including the requested URI and the client-facing host (cs-host), to identify traffic not ending in .adobe.com.
references:
  - https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_susp_flash_download_loc.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-10-25
modified: 2022-08-08
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1189
  - attack.execution
  - attack.t1204.002
  - attack.t1036.005
logsource:
  category: proxy
detection:
  selection:
    - c-uri|contains: /flash_install.php
    - c-uri|endswith: /install_flash_player.exe
  filter:
    cs-host|endswith: .adobe.com
  condition: selection and not filter
falsepositives:
  - Unknown flash download locations
level: high
license: DRL-1.1
related:
  - id: 4922a5dd-6743-4fc2-8e81-144374280997
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL