Sigma rule: Suspicious Windows Strings In URI

Rule

Title

Suspicious Windows Strings In URI

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-06-06

Modified

2023-01-02

File

rules/web/webserver_generic/web_susp_windows_path_uri.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication

Log source

category

webserver

Detection

selection:
    cs-uri-query|contains:
        - '=C:/Users'
        - '=C:/Program%20Files'
        - '=C:/Windows'
        - '=C%3A%5CUsers'
        - '=C%3A%5CProgram%20Files'
        - '=C%3A%5CWindows'
condition: selection

False positives (as the rule lists them)

• Legitimate application and websites that use windows paths in their URL

Tags

• attack.persistence
• attack.exfiltration
• attack.t1505.003

MITRE ATT&CK ids this rule names

• T1505.003

References

• https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/webserver_generic/web_susp_windows_path_uri.yml