Sigma rule: Download From Suspicious TLD - Blacklist

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-df93c961d710, updated 2023-05-18T00:00:00.000Z.

Rule

Title
Download From Suspicious TLD - Blacklist
Status
test
Level
low
Author
Florian Roth (Nextron Systems)
Date
2017-11-07
Modified
2023-05-18
File
rules/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml
Commit
ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects download of certain file types from hosts in suspicious TLDs

Log source

category
proxy

Detection

selection:
    c-uri-extension:
        - 'exe'
        - 'vbs'
        - 'bat'
        - 'rar'
        - 'ps1'
        - 'doc'
        - 'docm'
        - 'xls'
        - 'xlsm'
        - 'pptm'
        - 'rtf'
        - 'hta'
        - 'dll'
        - 'ws'
        - 'wsf'
        - 'sct'
        - 'zip'
        # If you want to add more extensions - see https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/
    cs-host|endswith:
        # Symantec / Chris Larsen analysis
        - '.country'
        - '.stream'
        - '.gdn'
        - '.mom'
        - '.xin'
        - '.kim'
        - '.men'
        - '.loan'
        - '.download'
        - '.racing'
        - '.online'
        - '.science'
        - '.ren'
        - '.gb'
        - '.win'
        - '.top'
        - '.review'
        - '.vip'
        - '.party'
        - '.tech'
        - '.xyz'
        - '.date'
        - '.faith'
        - '.zip'
        - '.cricket'
        - '.space'
        # McAfee report
        - '.info'
        - '.vn'
        - '.cm'
        - '.am'
        - '.cc'
        - '.asia'
        - '.ws'
        - '.tk'
        - '.biz'
        - '.su'
        - '.st'
        - '.ro'
        - '.ge'
        - '.ms'
        - '.pk'
        - '.nu'
        - '.me'
        - '.ph'
        - '.to'
        - '.tt'
        - '.name'
        - '.tv'
        - '.kz'
        - '.tc'
        - '.mobi'
        # Spamhaus
        - '.study'
        - '.click'
        - '.link'
        - '.trade'
        - '.accountant'
        # Spamhaus 2018 https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/
        - '.cf'
        - '.gq'
        - '.ml'
        - '.ga'
        # Custom
        - '.pw'
condition: selection

False positives (as the rule lists them)

  • All kinds of software downloads

Tags

  • attack.initial-access
  • attack.t1566
  • attack.execution
  • attack.t1203
  • attack.t1204.002

MITRE ATT&CK ids this rule names

Related rules

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml

Sources and licences

  • SigmaHQ

    "Download From Suspicious TLD - Blacklist" by Florian Roth (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml.
    Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License

    Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Download From Suspicious TLD - Blacklist",
entity page, dataset version ref-df93c961d710, updated 2023-05-18T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/00d0b5ab-1f55-4120-8e83-487c0a7baf19 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 00d0b5ab-1f55-4120-8e83-487c0a7baf19, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.