Ursnif dropper download URL pattern via proxy: PHP query leading to CAB with HTTP 200

title: "Ursnif dropper download URL pattern via proxy: PHP query leading to CAB with HTTP 200"
id: a8e1ca6e-a03c-43c9-b2f1-d7ad309dd072
status: stable
description: This rule matches web proxy requests where the requested URI contains '/.php?l=' and ends with '.cab', with an HTTP status code of 200. That pattern is characteristic of a dropper-stage download of a CAB payload, enabling malware retrieval during command-and-control or delivery workflows. It relies on proxy telemetry that includes the full requested URL and the response status code.
references:
  - https://notebook.community/Cyb3rWard0g/HELK/docker/helk-jupyter/notebooks/sigma/proxy_ursnif_malware
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Ursnif/proxy_malware_ursnif_download_url.yml
author: Thomas Patzke, Huntrule Team
date: 2019-12-19
modified: 2022-08-15
logsource:
  category: proxy
tags:
  - attack.command-and-control
  - attack.t1071.001
  - detection.emerging-threats
detection:
  selection:
    c-uri|contains|all:
      - /
      - .php\?l=
    c-uri|endswith: .cab
    sc-status: 200
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a36ce77e-30db-4ea0-8795-644d7af5dfb4
    type: derived