Potentially Suspicious File Download From ZIP TLD

Rule Info

Tags
attack.defense_evasion DEMO
Name
Potentially Suspicious File Download From ZIP TLD
Id
0bb4bbeb-fe52-4044-b40c-430a04577ebe
Date
2023-05-18 00:00:00
Modified
None
Description
Detects the download of a file with a potentially suspicious extension from a .zip top level domain.
Author
Florian Roth (Nextron Systems)
Type
Community Rule

Rule History

Title
Author
Commit
Date
feat: add more extensions and fix metadata
Nasreddine Bencherchali
2023-05-18
docs: add url
Florian Roth
2023-05-18
.zip domain stream hash - file type download
Florian Roth
2023-05-18