update: suspicious file activity related to file sharing websites

[swachchhanda000]

Summary of the Pull Request

Changelog

new - Curl File Upload To File Sharing Websites
update - Suspicious Remote AppX Package Locations - add more file sharing domains
update - BITS Transfer Job Download From File Sharing Domains - add more file sharing domains
update - Suspicious File Download From File Sharing Websites - File Stream - add more file sharing domains
update - Unusual File Download From File Sharing Websites - File Stream - add more file sharing domains
update - New Connection Initiated To Potential Dead Drop Resolver Domain - add more file sharing domains
update - Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder - add more file sharing domains
update - Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location - add more file sharing domains
update - Suspicious Download From File-Sharing Website Via Bitsadmin - add more file sharing domains
update - Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE - add more file sharing domains
update - Suspicious File Download From File Sharing Domain Via Curl.EXE - add more file sharing domains
update - Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE - add more file sharing domains
update - Suspicious File Download From File Sharing Domain Via Wget.EXE - add more file sharing domains

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[nasbench]

You literally just updated other lists that are bigger. Please add them

[swachchhanda000]

Well, I only added the domains that have documentation confirming curl support. Some domains are just for downloads, like cdn.discordapp.com. But I’ll check again to see if I missed any domains.

[swachchhanda000]

And btw some of the pre-existing domains in these rules are dead/not-reachable like anonfiles.com, Should i remove them as well?

[nasbench]

Depends on their actual use i would say. If you still find samples on VT still communicating with them we keep in the proc creation related rules since it would highly mean they are bad.

[nasbench]

Double check my comment before merging

[frack113]

we have the cased modified for it , but not sure many backend support it by now🐈‍⬛

[phantinuss]

We should start using it imo. This should be handled by the backend/pySigma.

[phantinuss]

All lists (such as here) that are the same and that should be maintained together should be linked in the metadata as "similar".

[frack113]

All the rule should add a related similar to at least one rule

[frack113]

Need to link the rules with like proc_creation_win_curl_upload_file_sharing_websites.yml