Ursnif C2 Traffic via Proxy URL Base64-Encoded Path with AVI/Image Pattern

title: Ursnif C2 Traffic via Proxy URL Base64-Encoded Path with AVI/Image Pattern
id: f0263e82-e5f0-4600-b653-dadfcdd277a1
status: stable
description: "This rule identifies proxy requests whose URL path appears Base64-like (containing encoded characters) and also includes a specific pattern: an AVI file extension and a '/images/' path segment. Attackers using this malware can blend command-and-control URLs into seemingly benign web paths while encoding parts of the URL. The detection relies on proxy telemetry with the full request URI, matching on substring indicators in the encoded URI and required URL components."
references:
  - https://www.fortinet.com/blog/threat-research/ursnif-variant-spreading-word-document.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Ursnif/proxy_malware_ursnif_c2_url.yml
author: Thomas Patzke, Huntrule Team
date: 2019-12-19
modified: 2021-08-09
tags:
  - attack.initial-access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.command-and-control
  - attack.t1071.001
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  b64encoding:
    c-uri|contains:
      - _2f
      - _2b
  urlpatterns:
    c-uri|contains|all:
      - .avi
      - /images/
  condition: b64encoding and urlpatterns
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 932ac737-33ca-4afd-9869-0d48b391fcc9
    type: derived