title: Ursnif Malware Download URL Pattern
id: a36ce77e-30db-4ea0-8795-644d7af5dfb4
status: stable
description: Detects download of Ursnif malware done by dropper documents.
references:
    - https://notebook.community/Cyb3rWard0g/HELK/docker/helk-jupyter/notebooks/sigma/proxy_ursnif_malware
author: Thomas Patzke
date: 2019-12-19
modified: 2022-08-15
logsource:
    category: proxy
tags:
    - attack.command-and-control
    - attack.t1071.001
    - detection.emerging-threats
detection:
    selection:
        c-uri|contains|all:
            - '/'
            - '.php\?l='
        c-uri|endswith: '.cab'
        sc-status: 200
    condition: selection
falsepositives:
    - Unknown
level: high