title: Microsoft Binary Suspicious Communication Endpoint
id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
status: test
description: Detects an executable in the Windows folder accessing suspicious domains
author: Florian Roth
references:
  - https://twitter.com/M_haggis/status/900741347035889665
  - https://twitter.com/M_haggis/status/1032799638213066752
date: 2018/08/30
modified: 2021/11/27
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationHostname|endswith:
      - 'dl.dropboxusercontent.com'
      - '.pastebin.com'
      - '.githubusercontent.com'       # includes both gists and github repositories
    Image|startswith: 'C:\Windows\'
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.lateral_movement
  - attack.t1105
