Proxy Suspicious TLD Downloads of Executable and Office File Types

title: Proxy Suspicious TLD Downloads of Executable and Office File Types
id: 73f77202-abc8-4159-800f-258b90924a0e
related:
  - id: b5de2919-b74a-4805-91a7-5049accbaefe
    type: similar
  - id: 00d0b5ab-1f55-4120-8e83-487c0a7baf19
    type: derived
status: test
description: This rule flags proxy requests where the requested URI ends with high-risk file extensions (for example exe, vbs, bat, ps1, hta, dll, doc/docm, xls/xlsm, pptm, rtf, zip) and the destination host ends with a set of suspicious top-level domains. The behavior matters because attackers commonly host and deliver malware or lure documents from dubious or newly registered TLDs to evade reputation-based defenses. It relies on proxy telemetry containing the requested URI extension and the destination host name to match against the extension list and suspicious TLD suffixes.
references:
  - https://www.symantec.com/connect/blogs/shady-tld-research-gdn-and-our-2016-wrap
  - https://promos.mcafee.com/en-US/PDF/MTMW_Report.pdf
  - https://www.spamhaus.org/statistics/tlds/
  - https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-11-07
modified: 2023-05-18
tags:
  - attack.initial-access
  - attack.t1566
  - attack.execution
  - attack.t1203
  - attack.t1204.002
logsource:
  category: proxy
detection:
  selection:
    c-uri-extension:
      - exe
      - vbs
      - bat
      - rar
      - ps1
      - doc
      - docm
      - xls
      - xlsm
      - pptm
      - rtf
      - hta
      - dll
      - ws
      - wsf
      - sct
      - zip
    cs-host|endswith:
      - .country
      - .stream
      - .gdn
      - .mom
      - .xin
      - .kim
      - .men
      - .loan
      - .download
      - .racing
      - .online
      - .science
      - .ren
      - .gb
      - .win
      - .top
      - .review
      - .vip
      - .party
      - .tech
      - .xyz
      - .date
      - .faith
      - .zip
      - .cricket
      - .space
      - .info
      - .vn
      - .cm
      - .am
      - .cc
      - .asia
      - .ws
      - .tk
      - .biz
      - .su
      - .st
      - .ro
      - .ge
      - .ms
      - .pk
      - .nu
      - .me
      - .ph
      - .to
      - .tt
      - .name
      - .tv
      - .kz
      - .tc
      - .mobi
      - .study
      - .click
      - .link
      - .trade
      - .accountant
      - .cf
      - .gq
      - .ml
      - .ga
      - .pw
  condition: selection
falsepositives:
  - All kinds of software downloads
level: low
license: DRL-1.1