Download From Suspicious TLD - Blacklist — Detection Rule

Detects download of certain file types from hosts in suspicious TLDs

Read the full analysis on IntelFusions