huntrule

Zeek HTTP Requests to Low Reputation TLDs or Suspicious File Extensions

Alerts on Zeek HTTP requests to low-reputation TLDs or URIs/MIME types consistent with executable payload delivery.

FreeReviewedSigma · Medium · v2
Product
zeek
Service
http
Author
@signalblur, Corelight (SigmaHQ), DRL 1.1
Published
2025-02-26
Updated
2026-07-31
AnalysisDetection
title: Zeek HTTP Requests to Low Reputation TLDs or Suspicious File Extensions
id: f07dd217-2991-413f-b75b-5097ed0b1f9b
status: experimental
description: Identifies Zeek HTTP traffic where the request host ends with a low reputation or commonly abused top-level domain, or the requested URI ends with a suspicious executable/script/archive shortcut extension. This matters because attackers often use newly registered or abused domains to host or stage malicious payloads and lure victims into fetching dangerous files. The rule relies on Zeek HTTP fields for the requested host, requested URI, and observed response MIME types corresponding to common malware file formats.
references:
  - https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows
  - https://www.spamhaus.org/reputation-statistics/cctlds/domains/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_http_susp_file_ext_from_susp_tld.yml
author: "@signalblur, Corelight, Huntrule Team"
date: 2025-02-26
tags:
  - attack.initial-access
  - attack.command-and-control
logsource:
  product: zeek
  service: http
detection:
  selection_suspicious_tld:
    host|endswith:
      - .bid
      - .by
      - .cf
      - .click
      - .cm
      - .ga
      - .gq
      - .ir
      - .kp
      - .loan
      - .ml
      - .mm
      - .party
      - .pw
      - .ru
      - .su
      - .sy
      - .tk
      - .top
      - .tv
      - .ve
      - .work
      - .xyz
  selection_malicious_ext:
    uri|endswith:
      - .bat
      - .bin
      - .cmd
      - .cpl
      - .dll
      - .dylib
      - .elf
      - .exe
      - .hta
      - .iso
      - .jar
      - .js
      - .lnk
      - .msi
      - .pif
      - .ps1
      - .py
      - .reg
      - .scr
      - .sh
      - .so
      - .vbs
      - .wsf
  selection_malicious_mime:
    resp_mime_types:
      - application/vnd.microsoft.portable-executable
      - application/x-bat
      - application/x-dosexec
      - application/x-elf
      - application/x-iso9660-image
      - application/x-java-archive
      - application/x-ms-shortcut
      - application/x-msdos-program
      - application/x-msdownload
      - application/x-python-code
      - application/x-sh
  condition: selection_suspicious_tld and 1 of selection_malicious_*
falsepositives:
  - Rare legitimate software downloads from low quality TLDs
level: medium
license: DRL-1.1
related:
  - id: 68c2c604-92ad-468b-bf4a-aac49adad08c
    type: derived