Suspicious Script Download from File Sharing Websites with Zone.Identifier
Detects the download of suspicious file types (batch, command, PowerShell scripts) from well-known file and paste sharing domains. This rule specifically looks for the creation of Zone.Identifier alternate data streams on these file types, which indicates they were downloaded from the internet.
Sigma
