Ursnif Malware Download URL Pattern
Detects download of Ursnif malware done by dropper documents.
Detection logic
selection
c-uri|contains|all:
- /
- .php\?l=
c-uri|endswith: .cab
sc-status: 200Condition
selectionRaw YAML
title: Ursnif Malware Download URL Pattern
id: a36ce77e-30db-4ea0-8795-644d7af5dfb4
status: stable
description: Detects download of Ursnif malware done by dropper documents.
references:
- https://notebook.community/Cyb3rWard0g/HELK/docker/helk-jupyter/notebooks/sigma/proxy_ursnif_malware
author: Thomas Patzke
date: 2019-12-19
modified: 2022-08-15
logsource:
category: proxy
tags:
- attack.command-and-control
- attack.t1071.001
- detection.emerging-threats
detection:
selection:
c-uri|contains|all:
- '/'
- '.php\?l='
c-uri|endswith: '.cab'
sc-status: 200
condition: selection
falsepositives:
- Unknown
level: highFalse positives
- Unknown