Download From Suspicious TLD - Blacklist

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•30

Detects the download of potentially malicious file types (executables, scripts, documents, archives, etc.) from domains using suspicious or commonly abused Top-Level Domains (TLDs). This rule aims to identify initial access attempts often associated with phishing or drive-by download campaigns.