Download From Suspicious TLD - Whitelist — Detection Rule

Detects executable downloads from suspicious remote systems

Read the full analysis on IntelFusions