Suspicious File Download From File Sharing Websites - File Stream

Severity: high
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects the download of suspicious file type from a well-known file and paste sharing domain

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1564.004` Hide Artifacts: NTFS File Attributes

Event coverage

Provider	Event ID	Title
Sysmon	15	FileCreateStreamHash

Stages and Predicates

Stage 1: `all of selection_domain`

or:
Contents|contains: .githubusercontent.com
Contents|contains: anonfiles.com
Contents|contains: cdn.discordapp.com
Contents|contains: ddns.net
Contents|contains: dl.dropboxusercontent.com
Contents|contains: ghostbin.co
Contents|contains: github.com
Contents|contains: glitch.me
Contents|contains: gofile.io
Contents|contains: hastebin.com
Contents|contains: mediafire.com
Contents|contains: mega.nz
Contents|contains: onrender.com
Contents|contains: pages.dev
Contents|contains: paste.ee
Contents|contains: pastebin.com
Contents|contains: pastebin.pl
Contents|contains: pastetext.net
Contents|contains: pixeldrain.com
Contents|contains: privatlab.com
Contents|contains: privatlab.net
Contents|contains: send.exploit.in
Contents|contains: sendspace.com
Contents|contains: storage.googleapis.com
Contents|contains: storjshare.io
Contents|contains: supabase.co
Contents|contains: temp.sh
Contents|contains: transfer.sh
Contents|contains: trycloudflare.com
Contents|contains: ufile.io
Contents|contains: w3spaces.com
Contents|contains: workers.dev

Stage 2: `all of selection_extension`

or:
TargetFilename|contains: '.cpl:Zone'
TargetFilename|contains: '.dll:Zone'
TargetFilename|contains: '.exe:Zone'
TargetFilename|contains: '.hta:Zone'
TargetFilename|contains: '.lnk:Zone'
TargetFilename|contains: '.one:Zone'
TargetFilename|contains: '.vbe:Zone'
TargetFilename|contains: '.vbs:Zone'
TargetFilename|contains: '.xll:Zone'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Contents`	match	`.githubusercontent.com` corpus 2 (sigma 2) `anonfiles.com` corpus 2 (sigma 2) `cdn.discordapp.com` corpus 2 (sigma 2) `ddns.net` corpus 2 (sigma 2) `dl.dropboxusercontent.com` corpus 2 (sigma 2) `ghostbin.co` corpus 2 (sigma 2) `github.com` corpus 2 (sigma 2) `glitch.me` corpus 2 (sigma 2) `gofile.io` corpus 2 (sigma 2) `hastebin.com` corpus 2 (sigma 2) `mediafire.com` corpus 2 (sigma 2) `mega.nz` corpus 2 (sigma 2) `onrender.com` corpus 2 (sigma 2) `pages.dev` corpus 2 (sigma 2) `paste.ee` corpus 2 (sigma 2) `pastebin.com` corpus 2 (sigma 2) `pastebin.pl` corpus 2 (sigma 2) `pastetext.net` corpus 2 (sigma 2) `pixeldrain.com` corpus 2 (sigma 2) `privatlab.com` corpus 2 (sigma 2) `privatlab.net` corpus 2 (sigma 2) `send.exploit.in` corpus 2 (sigma 2) `sendspace.com` corpus 2 (sigma 2) `storage.googleapis.com` corpus 2 (sigma 2) `storjshare.io` corpus 2 (sigma 2) `supabase.co` corpus 2 (sigma 2) `temp.sh` corpus 2 (sigma 2) `transfer.sh` corpus 2 (sigma 2) `trycloudflare.com` corpus 2 (sigma 2) `ufile.io` corpus 2 (sigma 2) `w3spaces.com` corpus 2 (sigma 2) `workers.dev` corpus 2 (sigma 2)
`TargetFilename`	match	`.cpl:Zone` `.dll:Zone` corpus 3 (sigma 3) `.exe:Zone` corpus 3 (sigma 3) `.hta:Zone` corpus 3 (sigma 3) `.lnk:Zone` corpus 2 (sigma 2) `.one:Zone` corpus 2 (sigma 2) `.vbe:Zone` corpus 3 (sigma 3) `.vbs:Zone` corpus 3 (sigma 3) `.xll:Zone` corpus 3 (sigma 3)