Detectionhightest
Flash Player Update from Suspicious Location
Detects a flashplayer update from an unofficial location
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Florian Roth (Nextron Systems)Created Wed Oct 25Updated Mon Aug 084922a5dd-6743-4fc2-8e81-144374280997web
Log Source
Proxy Log
CategoryProxy Log← raw: proxy
Detection Logic
Detection Logic2 selectors
detection:
selection:
- c-uri|contains: '/flash_install.php'
- c-uri|endswith: '/install_flash_player.exe'
filter:
cs-host|endswith: '.adobe.com'
condition: selection and not filterFalse Positives
Unknown flash download locations
References
MITRE ATT&CK
Rule Metadata
Rule ID
4922a5dd-6743-4fc2-8e81-144374280997
Status
test
Level
high
Type
Detection
Created
Wed Oct 25
Modified
Mon Aug 08
Path
rules/web/proxy_generic/proxy_susp_flash_download_loc.yml
Raw Tags
attack.initial-accessattack.t1189attack.executionattack.t1204.002attack.defense-evasionattack.t1036.005