DNS Query To MEGA Hosting Website - DNS Client

calendar Aug 12, 2024 · attack.exfiltration attack.t1567.002  ·
Share on: linkedin copy

Detects DNS queries for subdomains related to MEGA sharing website

Sigma rule (View on GitHub)

 1title: DNS Query To MEGA Hosting Website - DNS Client
 2id: 66474410-b883-415f-9f8d-75345a0a66a6
 3related:
 4    - id: 613c03ba-0779-4a53-8a1f-47f914a4ded3
 5      type: similar
 6status: test
 7description: Detects DNS queries for subdomains related to MEGA sharing website
 8references:
 9    - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
10author: Nasreddine Bencherchali (Nextron Systems)
11date: 2023-01-16
12tags:
13    - attack.exfiltration
14    - attack.t1567.002
15logsource:
16    product: windows
17    service: dns-client
18    definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.'
19detection:
20    selection:
21        EventID: 3008
22        QueryName|contains: 'userstorage.mega.co.nz'
23    condition: selection
24falsepositives:
25    - Legitimate DNS queries and usage of Mega
26level: medium

References

  • NCC Group’s Cyber Incident Response Team (CIRT) have responded to a large number of ransomware cases where frequently the open source tool Rclone being used for data exfiltration. Rclone provides a...


    Read More

Related rules

to-top