Unusual File Download from Direct IP Address
Detects the download of suspicious file types from URLs containing direct IP addresses. This rule specifically looks for the creation of Zone.Identifier alternate data streams (ADS) for common executable or script file extensions, indicating a file downloaded from the internet, combined with a URL that uses an IP address instead of a domain name. This behavior can be indicative of malware delivery or staging.
Sigma
