Ursnif Malware Download URL Pattern

Description

Detects download of Ursnif malware done by dropper documents.

Query · sigma

selection:
  c-uri|contains|all:
  - /
  - .php\?l=
  c-uri|endswith: .cab
  sc-status: 200
condition: selection

Known false positives

  • Unknown
Raw source Ursnif Malware Download URL Pattern · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Ursnif Malware Download URL Pattern
id: a36ce77e-30db-4ea0-8795-644d7af5dfb4
status: stable
description: Detects download of Ursnif malware done by dropper documents.
references:
    - https://notebook.community/Cyb3rWard0g/HELK/docker/helk-jupyter/notebooks/sigma/proxy_ursnif_malware
author: Thomas Patzke
date: 2019-12-19
modified: 2022-08-15
logsource:
    category: proxy
tags:
    - attack.command-and-control
    - attack.t1071.001
    - detection.emerging-threats
detection:
    selection:
        c-uri|contains|all:
            - '/'
            - '.php\?l='
        c-uri|endswith: '.cab'
        sc-status: 200
    condition: selection
falsepositives:
    - Unknown
level: high

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.