Ursnif dropper download URLs matching PHP l= parameter ending in CAB

Flags proxy responses where a request URI contains /.php?l= and ends with .cab, returning HTTP 200.

FreeReviewedSigma · High · v5

Category: proxy
Author: Thomas Patzke (SigmaHQ), DRL 1.1
Published: 2019-12-19
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

Identifies proxy web requests that return HTTP 200 where the requested URL contains '/'' and the PHP query parameter 'php?l=', and ends with a '.cab' file extension. This pattern is characteristic of malware delivery over HTTP, where attackers retrieve executable payloads disguised as files. The rule relies on proxy telemetry capturing the full request URI and the response status code.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious Encrypted Reverse Shell via Netcat and GPG on Linux

Malicious axios NPM Supply Chain C2 Domain Resolution

Suspicious Reverse Shell via Dev TCP or Netcat

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Malicious Renamed Python Interpreter Executing nvidia.py RAT

Ursnif dropper download URLs matching PHP l= parameter ending in CAB

Pivot detection · T1071.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

ursnif-dropper-download-url-pattern-via-proxy-php-query-leading-to-cab-with-http-a36ce77e

title: Ursnif dropper download URLs matching PHP l= parameter ending in CAB
id: a8e1ca6e-a03c-43c9-b2f1-d7ad309dd072
status: stable
description: Identifies proxy web requests that return HTTP 200 where the requested URL contains '/'' and the PHP query parameter 'php?l=', and ends with a '.cab' file extension. This pattern is characteristic of malware delivery over HTTP, where attackers retrieve executable payloads disguised as files. The rule relies on proxy telemetry capturing the full request URI and the response status code.
references:
  - https://notebook.community/Cyb3rWard0g/HELK/docker/helk-jupyter/notebooks/sigma/proxy_ursnif_malware
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Ursnif/proxy_malware_ursnif_download_url.yml
author: Thomas Patzke, Huntrule Team
date: 2019-12-19
modified: 2022-08-15
logsource:
  category: proxy
tags:
  - attack.command-and-control
  - attack.t1071.001
  - detection.emerging-threats
detection:
  selection:
    c-uri|contains|all:
      - /
      - .php\?l=
    c-uri|endswith: .cab
    sc-status: 200
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a36ce77e-30db-4ea0-8795-644d7af5dfb4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL