Detectionhightest

Unusual File Download from Direct IP Address

Detects the download of suspicious file type from URLs with IP

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)Created Wed Sep 07Updated Fri Feb 10025bd229-fd1f-4fdb-97ab-20006e1a5368windows

Log Source

WindowsAlternate Data Stream

ProductWindows← raw: windows

CategoryAlternate Data Stream← raw: create_stream_hash

Detection Logic

detection:
    selection:
        Contents|re: 'http[s]?://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
        TargetFilename|contains:
            - '.ps1:Zone'
            - '.bat:Zone'
            - '.exe:Zone'
            - '.vbe:Zone'
            - '.vbs:Zone'
            - '.dll:Zone'
            - '.one:Zone'
            - '.cmd:Zone'
            - '.hta:Zone'
            - '.xll:Zone'
            - '.lnk:Zone'
    condition: selection