HTTP Request to Low Reputation TLD or Suspicious File Extension

SigmaHQ Detections@sigmaHQ

•updated Mar 4, 2025•0•0•0

Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity.