Detectionhightest

Potentially Suspicious File Download From ZIP TLD

Detects the download of a file with a potentially suspicious extension from a .zip top level domain.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Thu May 180bb4bbeb-fe52-4044-b40c-430a04577ebewindows

Log Source

WindowsAlternate Data Stream

ProductWindows← raw: windows

CategoryAlternate Data Stream← raw: create_stream_hash

Detection Logic

detection:
    selection:
        Contents|contains: '.zip/'
        TargetFilename|contains:
            - '.bat:Zone'
            - '.dat:Zone'
            - '.dll:Zone'
            - '.doc:Zone'
            - '.docm:Zone'
            - '.exe:Zone'
            - '.hta:Zone'
            - '.pptm:Zone'
            - '.ps1:Zone'
            - '.rar:Zone'
            - '.rtf:Zone'
            - '.sct:Zone'
            - '.vbe:Zone'
            - '.vbs:Zone'
            - '.ws:Zone'
            - '.wsf:Zone'
            - '.xll:Zone'
            - '.xls:Zone'
            - '.xlsm:Zone'
            - '.zip:Zone'
    condition: selection