Sigma high test sigma

Raw Paste Service Access

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

View Source

Detection Logic

{
  "selection": {
    "c-uri
| contains": [
      ".paste.ee/r/",
      ".pastebin.com/raw/",
      ".hastebin.com/raw/",
      ".ghostbin.co/paste/*/raw/",
      "pastetext.net/",
      "pastebin.pl/",
      "paste.ee/"
    ]
  },
  "condition": "selection"
}

False Positives

⚠ User activity (e.g. developer that shared and copied code snippets and used the raw link instead of just copy & paste)

Field Validations

Loading…

Comments (0)

Loading comments...