Windows suspicious file download URLs using direct IP address with script/binary extensions

title: Windows suspicious file download URLs using direct IP address with script/binary extensions
id: 7070b54b-6d54-43db-baca-be7c21fb1dbd
status: test
description: This rule identifies Windows file stream creation events where the contents contain an HTTP/HTTPS URL directly referencing an IP address and the target filename includes suspicious file extensions followed by ':Zone'. This pattern can indicate remote payload delivery by an attacker without using a domain name, commonly observed in stealthy download and execution staging. It relies on telemetry from Windows file stream creation/hash events, including the URL present in the stream contents and the target filename value.
references:
  - https://github.com/trustedsec/SysmonCommunityGuide/blob/adcdfee20999f422b974c8d4149bf4c361237db7/chapters/file-stream-creation-hash.md
  - https://labs.withsecure.com/publications/detecting-onenote-abuse
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_susp_ip_domains.yml
author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2022-09-07
modified: 2023-02-10
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  product: windows
  category: create_stream_hash
detection:
  selection:
    Contents|re: http[s]?://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}
    TargetFilename|contains:
      - .ps1:Zone
      - .bat:Zone
      - .exe:Zone
      - .vbe:Zone
      - .vbs:Zone
      - .dll:Zone
      - .one:Zone
      - .cmd:Zone
      - .hta:Zone
      - .xll:Zone
      - .lnk:Zone
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 025bd229-fd1f-4fdb-97ab-20006e1a5368
    type: derived