Detectionmediumtest

Download from Suspicious Dyndns Hosts

Detects download of certain file types from hosts with dynamic DNS names (selected list)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Wed Nov 08Updated Thu May 18195c1119-ef07-4909-bb12-e66f5e07bf3cweb

Log Source

Proxy Log

CategoryProxy Log← raw: proxy

Detection Logic

detection:
    selection:
        c-uri-extension:
            - 'exe'
            - 'vbs'
            - 'bat'
            - 'rar'
            - 'ps1'
            - 'doc'
            - 'docm'
            - 'xls'
            - 'xlsm'
            - 'pptm'
            - 'rtf'
            - 'hta'
            - 'dll'
            - 'ws'
            - 'wsf'
            - 'sct'
            - 'zip'
            # If you want to add more extensions - see https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/
        cs-host|endswith:
            - '.hopto.org'
            - '.no-ip.org'
            - '.no-ip.info'
            - '.no-ip.biz'
            - '.no-ip.com'
            - '.noip.com'
            - '.ddns.name'
            - '.myftp.org'
            - '.myftp.biz'
            - '.serveblog.net'
            - '.servebeer.com'
            - '.servemp3.com'
            - '.serveftp.com'
            - '.servequake.com'
            - '.servehalflife.com'
            - '.servehttp.com'
            - '.servegame.com'
            - '.servepics.com'
            - '.myvnc.com'
            - '.ignorelist.com'
            - '.jkub.com'
            - '.dlinkddns.com'
            - '.jumpingcrab.com'
            - '.ddns.info'
            - '.mooo.com'
            - '.dns-dns.com'
            - '.strangled.net'
            - '.adultdns.net'
            - '.craftx.biz'
            - '.ddns01.com'
            - '.dns53.biz'
            - '.dnsapi.info'
            - '.dnsd.info'
            - '.dnsdynamic.com'
            - '.dnsdynamic.net'
            - '.dnsget.org'
            - '.fe100.net'
            - '.flashserv.net'
            - '.ftp21.net'
            - '.http01.com'
            - '.http80.info'
            - '.https443.com'
            - '.imap01.com'
            - '.kadm5.com'
            - '.mysq1.net'
            - '.ns360.info'
            - '.ntdll.net'
            - '.ole32.com'
            - '.proxy8080.com'
            - '.sql01.com'
            - '.ssh01.com'
            - '.ssh22.net'
            - '.tempors.com'
            - '.tftpd.net'
            - '.ttl60.com'
            - '.ttl60.org'
            - '.user32.com'
            - '.voip01.com'
            - '.wow64.net'
            - '.x64.me'
            - '.xns01.com'
            - '.dyndns.org'
            - '.dyndns.info'
            - '.dyndns.tv'
            - '.dyndns-at-home.com'
            - '.dnsomatic.com'
            - '.zapto.org'
            - '.webhop.net'
            - '.25u.com'
            - '.slyip.net'
    condition: selection