Malware authors often abuse free or public services to distribute malicious content. They may host payloads on DropBox or Discord, Google Drive, PasteBin, or a number of services.

Searching for the domains used by these services can uncover malware in surprising places.

Ngrok

ngrok is used to tunnel traffic through HTTP. Despite being a legitimate service, it is often used maliciously.

rule ngrok_url
{
	meta:
		description = "Contains ngrok.io string"

	strings:
		$ = ".ngrok.io" ascii wide

	condition:
		all of them
}

DropBox

rule dropbox_url
{
	meta:
		description = "Contains a DropBox URL"

	strings:
		$ = "https://dl.dropbox.com/" ascii wide

	condition:
		all of them
}

rule dropbox
{
	meta:
		description = "Contains dropbox.com"

	strings:
		$ = "dropbox.com" ascii wide

	condition:
		all of them
}

Others

I don’t think it makes a ton of sense to list all of the potentially abused services out there. As I encounter these being abused in the wild, I tend to create new rules for them.

These are low confidence rules, but I’ve found several samples that don’t match any of my rules except for these.