Windows: Suspicious File Downloads from Direct IP URLs with Executable Attachments

title: "Windows: Suspicious File Downloads from Direct IP URLs with Executable Attachments"
id: 7070b54b-6d54-43db-baca-be7c21fb1dbd
status: test
description: This rule flags file-stream creation events where the target filename contains attachment-style indicators (e.g., .ps1, .bat, .exe, .dll, .one, .lnk) and the source URL is a direct IPv4 address over HTTP/HTTPS. Direct IP-based downloads can bypass typical domain reputation controls and are commonly used to deliver payloads via seemingly benign file transfers. It relies on Windows telemetry that includes the stream contents URL and the target filename, as captured by create_stream_hash events.
references:
  - https://github.com/trustedsec/SysmonCommunityGuide/blob/adcdfee20999f422b974c8d4149bf4c361237db7/chapters/file-stream-creation-hash.md
  - https://labs.withsecure.com/publications/detecting-onenote-abuse
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_susp_ip_domains.yml
author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-07
modified: 2023-02-10
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  product: windows
  category: create_stream_hash
detection:
  selection:
    Contents|re: http[s]?://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
    TargetFilename|contains:
      - .ps1:Zone
      - .bat:Zone
      - .exe:Zone
      - .vbe:Zone
      - .vbs:Zone
      - .dll:Zone
      - .one:Zone
      - .cmd:Zone
      - .hta:Zone
      - .xll:Zone
      - .lnk:Zone
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 025bd229-fd1f-4fdb-97ab-20006e1a5368
    type: derived