Zeek HTTP Requests to Low-Reputation TLDs or Suspicious Executable File Types

title: Zeek HTTP Requests to Low-Reputation TLDs or Suspicious Executable File Types
id: f07dd217-2991-413f-b75b-5097ed0b1f9b
status: experimental
description: This rule flags Zeek HTTP traffic where the request host ends with a set of low-reputation top-level domains, or where the requested URI ends with commonly abused executable/script extensions. It also triggers when the HTTP response MIME type indicates downloadable binaries, scripts, ISO images, shortcuts, or archives commonly used for initial access. These patterns matter because attackers frequently host malware on lower-quality domains and serve payloads using file type cues. The detection relies on Zeek HTTP telemetry fields for the requested host, URI suffix, and response MIME types.
references:
  - https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows
  - https://www.spamhaus.org/reputation-statistics/cctlds/domains/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_http_susp_file_ext_from_susp_tld.yml
author: "@signalblur, Corelight, Huntrule Team"
date: 2025-02-26
tags:
  - attack.initial-access
  - attack.command-and-control
logsource:
  product: zeek
  service: http
detection:
  selection_suspicious_tld:
    host|endswith:
      - .bid
      - .by
      - .cf
      - .click
      - .cm
      - .ga
      - .gq
      - .ir
      - .kp
      - .loan
      - .ml
      - .mm
      - .party
      - .pw
      - .ru
      - .su
      - .sy
      - .tk
      - .top
      - .tv
      - .ve
      - .work
      - .xyz
  selection_malicious_ext:
    uri|endswith:
      - .bat
      - .bin
      - .cmd
      - .cpl
      - .dll
      - .dylib
      - .elf
      - .exe
      - .hta
      - .iso
      - .jar
      - .js
      - .lnk
      - .msi
      - .pif
      - .ps1
      - .py
      - .reg
      - .scr
      - .sh
      - .so
      - .vbs
      - .wsf
  selection_malicious_mime:
    resp_mime_types:
      - application/vnd.microsoft.portable-executable
      - application/x-bat
      - application/x-dosexec
      - application/x-elf
      - application/x-iso9660-image
      - application/x-java-archive
      - application/x-ms-shortcut
      - application/x-msdos-program
      - application/x-msdownload
      - application/x-python-code
      - application/x-sh
  condition: selection_suspicious_tld and 1 of selection_malicious_*
falsepositives:
  - Rare legitimate software downloads from low quality TLDs
level: medium
license: DRL-1.1
related:
  - id: 68c2c604-92ad-468b-bf4a-aac49adad08c
    type: derived