mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 09:25:17 +00:00
25 lines
505 B
YAML
25 lines
505 B
YAML
|
title: Ursnif Malware Download URL Pattern
|
||
|
|
id: a36ce77e-30db-4ea0-8795-644d7af5dfb4
|
||
|
|
status: stable
|
||
|
|
description: Detects download of Ursnif malware done by dropper documents.
|
||
|
|
author: Thomas Patzke
|
||
|
|
date: 2019/12/19
|
||
|
|
modified: 2021/08/09
|
||
|
|
logsource:
|
||
|
|
category: proxy
|
||
|
|
detection:
|
||
|
|
selection:
|
||
|
|
c-uri|contains|all:
|
||
|
|
- '/'
|
||
|
|
- '.php?l='
|
||
|
|
c-uri|endswith: '.cab'
|
||
|
|
sc-status: 200
|
||
|
|
condition: selection
|
||
|
|
fields:
|
||
|
|
- c-ip
|
||
|
|
- c-uri
|
||
|
|
- sc-bytes
|
||
|
|
- c-ua
|
||
|
|
falsepositives:
|
||
|
|
- Unknown
|
||
|
|
level: critical
|