Download From Suspicious TLD - Whitelist

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•24

Detects downloads of potentially malicious file types (executables, scripts, documents, archives) from domains that are not common Top-Level Domains (TLDs). This rule aims to identify suspicious file transfers that bypass typical, trusted sources.