2019-12-05 07:54:42 +00:00
title : Raw Paste Service Access
id : 5468045b-4fcc-4d1a-973c-c9c9578edacb
status : experimental
description : Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form
references :
- https://www.virustotal.com/gui/domain/paste.ee/relations
author : Florian Roth
date : 2019 /12/05
tags :
- attack.t1102
- attack.defense_evasion
logsource :
category : proxy
detection :
selection :
c-uri|contains :
- '.paste.ee/r/'
- '.pastebin.com/raw/'
2019-12-05 20:16:20 +00:00
- '.hastebin.com/raw/'
2020-02-26 08:43:29 +00:00
- '.ghostbin.co/paste/*/raw/'
2019-12-05 07:54:42 +00:00
condition : selection
fields :
- ClientIP
2019-12-06 23:11:33 +00:00
- c-uri
- c-useragent
2019-12-05 07:54:42 +00:00
falsepositives :
- User activity (e.g. developer that shared and copied code snippets and used the raw link instead of just copy & paste)
level : high
