Sigma critical stable sigma

Ursnif Malware C2 URL Pattern

Detects Ursnif C2 traffic.

View Source

Detection Logic

{
  "b64encoding": {
    "c-uri
| contains": [
      "_2f",
      "_2b"
    ]
  },
  "urlpatterns": {
    "c-uri
| contains
| all": [
      ".avi",
      "/images/"
    ]
  },
  "condition": "b64encoding and urlpatterns"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...