Ursnif Malware Download URL Pattern

SigmaHQ Detections@sigmaHQ

•updated Jun 12, 2025•0•25

Detects the download of Ursnif malware based on specific URL patterns and a successful HTTP status code. The rule looks for URIs containing a forward slash, '.php?l=', and ending with '.cab', combined with an HTTP status code of 200, indicating a successful download.