Proxy: Flag Executable Downloads from Non-Whitelisted Suspicious TLDs

title: "Proxy: Flag Executable Downloads from Non-Whitelisted Suspicious TLDs"
id: 568913af-0f74-495f-960f-c4a229b0bfc2
related:
  - id: 00d0b5ab-1f55-4120-8e83-487c0a7baf19
    type: similar
  - id: b5de2919-b74a-4805-91a7-5049accbaefe
    type: derived
status: test
description: This rule identifies proxy requests where the requested resource has executable or script/document-related file extensions (e.g., .exe, .vbs, .bat, .ps1, .hta, .dll, .sct) and the URL host does not end with commonly used whitelisted TLDs. Attackers commonly leverage direct downloads of malicious payloads from remote infrastructure to gain initial access or trigger execution chains. It relies on proxy telemetry capturing the full request URI and the client-to-remote destination hostname.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_download_susp_tlds_whitelist.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-13
modified: 2023-05-18
tags:
  - attack.initial-access
  - attack.t1566
  - attack.execution
  - attack.t1203
  - attack.t1204.002
logsource:
  category: proxy
detection:
  selection:
    c-uri-extension:
      - exe
      - vbs
      - bat
      - rar
      - ps1
      - doc
      - docm
      - xls
      - xlsm
      - pptm
      - rtf
      - hta
      - dll
      - ws
      - wsf
      - sct
      - zip
  filter:
    cs-host|endswith:
      - .com
      - .org
      - .net
      - .edu
      - .gov
      - .uk
      - .ca
      - .de
      - .jp
      - .fr
      - .au
      - .us
      - .ch
      - .it
      - .nl
      - .se
      - .no
      - .es
  condition: selection and not filter
falsepositives:
  - All kind of software downloads
level: low
license: DRL-1.1