Ursnif dropper download URLs matching PHP l= parameter ending in CAB

Flags proxy responses where a request URI contains /.php?l= and ends with .cab, returning HTTP 200.

FreeReviewedSigma · High · v5

Category: proxy
Author: Thomas Patzke (SigmaHQ), DRL 1.1
Published: 2019-12-19
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

Identifies proxy web requests that return HTTP 200 where the requested URL contains '/'' and the PHP query parameter 'php?l=', and ends with a '.cab' file extension. This pattern is characteristic of malware delivery over HTTP, where attackers retrieve executable payloads disguised as files. The rule relies on proxy telemetry capturing the full request URI and the response status code.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious Interlock RAT FileFix Download-Cradle via PowerShell WebClient with PowerShell User-Agent (via ps_script)

Suspicious Cobalt Strike Malleable Profile Beaconing via Legacy MSIE9 User-Agent and IE Compatibility URIs (via proxy)

Malicious Cobalt Strike Default Named Pipe Activity

Malicious VoidLink Kernel Rootkit C2 Endpoints via HTTP (via proxy)

Malicious EtherRAT C2 Exfiltration Endpoints via HTTP (via proxy)

Possible PlugX and NPS Proxy Command and Control Domain Lookup

Possible Backdoor Mistic Command and Control Domain Lookup

Suspicious Weaver Ant In-Memory Web Shell Marker in Web Request (via webserver)

Malicious BlueNoroff C2 Communication via cur1-agent User-Agent (via proxy)

Ursnif dropper download URLs matching PHP l= parameter ending in CAB

Pivot detection · T1071.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

ursnif-dropper-download-url-pattern-via-proxy-php-query-leading-to-cab-with-http-a36ce77e

title: Ursnif dropper download URLs matching PHP l= parameter ending in CAB
id: a8e1ca6e-a03c-43c9-b2f1-d7ad309dd072
status: stable
description: Identifies proxy web requests that return HTTP 200 where the requested URL contains '/'' and the PHP query parameter 'php?l=', and ends with a '.cab' file extension. This pattern is characteristic of malware delivery over HTTP, where attackers retrieve executable payloads disguised as files. The rule relies on proxy telemetry capturing the full request URI and the response status code.
references:
  - https://notebook.community/Cyb3rWard0g/HELK/docker/helk-jupyter/notebooks/sigma/proxy_ursnif_malware
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Ursnif/proxy_malware_ursnif_download_url.yml
author: Thomas Patzke, Huntrule Team
date: 2019-12-19
modified: 2022-08-15
logsource:
  category: proxy
tags:
  - attack.command-and-control
  - attack.t1071.001
  - detection.emerging-threats
detection:
  selection:
    c-uri|contains|all:
      - /
      - .php\?l=
    c-uri|endswith: .cab
    sc-status: 200
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a36ce77e-30db-4ea0-8795-644d7af5dfb4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL