Detectionhightest

Suspicious File Download From File Sharing Websites - File Stream

Detects the download of suspicious file type from a well-known file and paste sharing domain

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Wed Aug 24Updated Wed Dec 1052182dfb-afb7-41db-b4bc-5336cb29b464windows

Log Source

WindowsAlternate Data Stream

ProductWindows← raw: windows

CategoryAlternate Data Stream← raw: create_stream_hash

Detection Logic

detection:
    selection_domain:
        Contents|contains:
            - '.githubusercontent.com'       # Includes both gists and github repositories / Michael Haag (idea)
            - 'anonfiles.com'
            - 'cdn.discordapp.com'
            - 'ddns.net'
            - 'dl.dropboxusercontent.com'
            - 'ghostbin.co'
            - 'github.com'
            - 'glitch.me'
            - 'gofile.io'
            - 'hastebin.com'
            - 'mediafire.com'
            - 'mega.nz'
            - 'onrender.com'
            - 'pages.dev'
            - 'paste.ee'
            - 'pastebin.com'
            - 'pastebin.pl'
            - 'pastetext.net'
            - 'pixeldrain.com'
            - 'privatlab.com'
            - 'privatlab.net'
            - 'send.exploit.in'
            - 'sendspace.com'
            - 'storage.googleapis.com'
            - 'storjshare.io'
            - 'supabase.co'
            - 'temp.sh'
            - 'transfer.sh'
            - 'trycloudflare.com'
            - 'ufile.io'
            - 'w3spaces.com'
            - 'workers.dev'
    selection_extension:
        TargetFilename|contains:
            - '.cpl:Zone'
            - '.dll:Zone'
            - '.exe:Zone'
            - '.hta:Zone'
            - '.lnk:Zone'
            - '.one:Zone'
            - '.vbe:Zone'
            - '.vbs:Zone'
            - '.xll:Zone'
    condition: all of selection_*