Proxy: Block Suspicious Executable Downloads from Non-Trusted Top-Level Domains

ATT&CK techniques

Initial Access → Execution

Recon
Resource Dev
Initial Access
- T1566Phishing
Execution
- T1203Exploitation for Client Execution
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags proxy requests where the requested URI ends with high-risk file extensions (e.g., exe, vbs, bat, ps1, hta, dll) while the host ends with a restricted set of top-level domains. Attackers commonly use web-facing infrastructure to deliver malware or scripts for initial access and execution. The detection relies on proxy telemetry capturing requested URI paths and the destination host.

Reporting behind it

Related detections9 linkedT1203 — drag to rearrange

Proxy downloads of executable and document files from suspicious TLDs (blacklisted domains)

Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831

Windows Registry Modification Indicative of CVE-2021-31979 and CVE-2021-33771 Exploitation

Windows file event detection for CVE-2021-31979 and CVE-2021-33771 exploitation artifact paths

Windows process creation: Winword launching FLTLDR.exe exploitation behavior

Windows Process Creation: EQNEDT32.EXE Used as CVE-2017-11882 Exploit Dropper Parent

Windows: Winword spawning csc.exe indicative of CVE-2017-8759 exploitation

Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document

Suspicious NFe-Themed Brazilian Lure Executable Execution

Proxy: Block Suspicious Executable Downloads from Non-Trusted Top-Level Domains

Pivot detection · T1203 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

proxy-flag-executable-downloads-from-non-whitelisted-suspicious-tlds-b5de2919

title: "Proxy: Block Suspicious Executable Downloads from Non-Trusted Top-Level Domains"
id: 568913af-0f74-495f-960f-c4a229b0bfc2
related:
  - id: 00d0b5ab-1f55-4120-8e83-487c0a7baf19
    type: similar
  - id: b5de2919-b74a-4805-91a7-5049accbaefe
    type: derived
status: test
description: This rule flags proxy requests where the requested URI ends with high-risk file extensions (e.g., exe, vbs, bat, ps1, hta, dll) while the host ends with a restricted set of top-level domains. Attackers commonly use web-facing infrastructure to deliver malware or scripts for initial access and execution. The detection relies on proxy telemetry capturing requested URI paths and the destination host.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_download_susp_tlds_whitelist.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-13
modified: 2023-05-18
tags:
  - attack.initial-access
  - attack.t1566
  - attack.execution
  - attack.t1203
  - attack.t1204.002
logsource:
  category: proxy
detection:
  selection:
    c-uri-extension:
      - exe
      - vbs
      - bat
      - rar
      - ps1
      - doc
      - docm
      - xls
      - xlsm
      - pptm
      - rtf
      - hta
      - dll
      - ws
      - wsf
      - sct
      - zip
  filter:
    cs-host|endswith:
      - .com
      - .org
      - .net
      - .edu
      - .gov
      - .uk
      - .ca
      - .de
      - .jp
      - .fr
      - .au
      - .us
      - .ch
      - .it
      - .nl
      - .se
      - .no
      - .es
  condition: selection and not filter
falsepositives:
  - All kind of software downloads
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL