HTTP Request to Low Reputation TLD or Suspicious File Extension

SigmaHQ Detections@sigmaHQ

•updated Mar 4, 2025•0•24

Detects HTTP requests to low reputation Top-Level Domains (TLDs) or for files with suspicious extensions, which may indicate an attempt to download malicious content or establish command and control.