Proxy Requests to Raw Paste Service Endpoints

Alerts on proxy requests for raw paste service URLs that can be used to stage or fetch malicious payloads.

FreeUnreviewedSigmahighv1

proxy-requests-to-raw-paste-service-endpoints-5468045b

title: Proxy Requests to Raw Paste Service Endpoints
id: 988cc414-d4ad-41dd-a555-a3ad5bb4e491
status: test
description: This rule flags proxy traffic targeting raw-content endpoints across multiple paste services (e.g., .paste.ee/r/, pastebin.com/raw/, hastebin.com/raw/, and similar URL patterns). Attackers commonly use these raw paste endpoints to stage or retrieve additional payloads in follow-on activity, because the content is served directly for consumption by tooling. The detection relies on proxy request URI telemetry matching the specified raw URL substrings.
references:
  - https://www.virustotal.com/gui/domain/paste.ee/relations
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_raw_paste_service_access.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-12-05
modified: 2023-01-19
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1102.001
  - attack.t1102.003
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains:
      - .paste.ee/r/
      - .pastebin.com/raw/
      - .hastebin.com/raw/
      - .ghostbin.co/paste/*/raw/
      - pastetext.net/
      - pastebin.pl/
      - paste.ee/
  condition: selection
falsepositives:
  - User activity (e.g. developer that shared and copied code snippets and used the raw link instead of just copy & paste)
level: high
license: DRL-1.1
related:
  - id: 5468045b-4fcc-4d1a-973c-c9c9578edacb
    type: derived

What it detects

This rule flags proxy traffic targeting raw-content endpoints across multiple paste services (e.g., .paste.ee/r/, pastebin.com/raw/, hastebin.com/raw/, and similar URL patterns). Attackers commonly use these raw paste endpoints to stage or retrieve additional payloads in follow-on activity, because the content is served directly for consumption by tooling. The detection relies on proxy request URI telemetry matching the specified raw URL substrings.

Known false positives

User activity (e.g. developer that shared and copied code snippets and used the raw link instead of just copy & paste)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.