Rule Info
Name
HTTP Request to Low Reputation TLD or Suspicious File Extension
Author
@signalblur, Corelight
Description
Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity.
Reference
Date
2025-02-26 00:00:00
Modified
None
Id
68c2c604-92ad-468b-bf4a-aac49adad08c
Tags
attack.initial-access attack.command-and-control
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
signalblur
Merge PR #5214 from @signalblur - Add `HTTP Request to Low Reputation TLD or Suspicious File Extension`
2025-03-04
Scan your endpoints, forensic images or collected files with our portable scanner THOR