Red Lamassu Open-Directory Bulk Tool Staging via HTTP (T1105)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects bulk file downloads of executable or script content from web proxies using automated or headless client agents (e.g., curl, wget) where no browser-like Referer is present. The rule aggregates these downloads within a 10-minute window and correlates them with endpoint Sysmon file creation events in non-standard directories, indicating potential tool staging or malware delivery.