Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder

{
  "network_connection": {
    "EventID": 3,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection_paths": {
    "Image
| contains": [
      ":\\$Recycle.bin",
      ":\\Perflogs\\",
      ":\\Temp\\",
      ":\\Users\\Default\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Fonts\\",
      ":\\Windows\\IME\\",
      ":\\Windows\\System32\\Tasks\\",
      ":\\Windows\\Tasks\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Temp\\",
      "\\config\\systemprofile\\",
      "\\Windows\\addins\\"
    ]
  },
  "selection_domains": {
    "Initiated": "true",
    "DestinationHostname
| endswith": [
      ".githubusercontent.com",
      "0x0.st",
      "anonfiles.com",
      "bashupload.com",
      "cdn.discordapp.com",
      "chunk.io",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.co.nz",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "pixeldrain.com",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev",
      "x0.at"
    ]
  },
  "condition": "network_connection and (all of selection_*)"
}

False Positives

• ⚠ Some installers located in the temp directory might communicate with the Github domains in order to download additional software. Baseline these cases or move the github domain to a lower level hunting rule.