Sigma high test sigma

Suspicious File Download From File Sharing Websites - File Stream

Detects the download of suspicious file type from a well-known file and paste sharing domain

View Source

Detection Logic

{
  "selection_domain": {
    "Contents
| contains": [
      ".githubusercontent.com",
      "0x0.st",
      "anonfiles.com",
      "bashupload.com",
      "cdn.discordapp.com",
      "chunk.io",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "pixeldrain.com",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev",
      "x0.at"
    ]
  },
  "selection_extension": {
    "TargetFilename
| contains": [
      ".cpl:Zone",
      ".dll:Zone",
      ".exe:Zone",
      ".hta:Zone",
      ".lnk:Zone",
      ".one:Zone",
      ".vbe:Zone",
      ".vbs:Zone",
      ".xll:Zone"
    ]
  },
  "condition": "all of selection_*"
}

False Positives

  • ⚠ Some false positives might occur with binaries download via Github

Field Validations

Loading…

Comments (0)

Loading comments...