Rule: Suspicious executable downloads

2017-03-13 16:11:43 +01:00
parent 85c298c43c
commit a87d513efa
1 changed files with 33 additions and 0 deletions
@@ -0,0 +1,33 @@
+title: Executable Download from Suspicious Host
+status: experimental
+description: Detects executable downloads from suspicious remote systems. The whitelist should be extended as needed. 
+author: Florian Roth
+logsource:
+    type: proxy
+detection:
+    selection:
+        c-uri-extension: 'exe'
+    filter:
+        r-dns: 
+            - '*.com'
+            - '*.org'
+            - '*.net'
+            - '*.edu'
+            - '*.gov'
+            - '*.uk'
+            - '*.ca'
+            - '*.de'
+            - '*.jp'
+            - '*.fr'
+            - '*.au'
+            - '*.us'
+            - '*.ch'
+            - '*.it'
+            - '*.nl'
+            - '*.se'
+            - '*.no'
+            - '*.es'    
+    condition: selection
+falsepositives:
+    - All kind of software downloads
+level: low