PwnDrp Access

Title: PwnDrp Access
Status: test
Description:Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity
References:
  -https://breakdev.org/pwndrop/
Author: Florian Roth (Nextron Systems)
Date: 2020-04-15
modified:2021-11-27
Tags:

• -'attack.command-and-control'
• -'attack.t1071.001'
• -'attack.t1102.001'
• -'attack.t1102.003'

Logsource:

• category: proxy

Detection:
  selection:
    c-uri|contains: '/pwndrop/'
  condition:selection
Falsepositives:
  -Unknown
Level: critical