DNS Query for Anonfiles.com Domain - Sysmon
Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes
Sigma rule (View on GitHub)
1title: DNS Query for Anonfiles.com Domain - Sysmon
2id: 065cceea-77ec-4030-9052-fc0affea7110
3related:
4 - id: 29f171d7-aa47-42c7-9c7b-3c87938164d9
5 type: similar
6status: test
7description: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes
8references:
9 - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
10author: pH-T (Nextron Systems)
11date: 2022-07-15
12modified: 2023-01-16
13tags:
14 - attack.exfiltration
15 - attack.t1567.002
16logsource:
17 product: windows
18 category: dns_query
19detection:
20 selection:
21 QueryName|contains: '.anonfiles.com'
22 condition: selection
23falsepositives:
24 - Rare legitimate access to anonfiles.com
25level: high
References
-
BlackByte is a ransomware group that has been building a name for itself since 2021. Like its contemporaries, it has gone after critical infrastructure for a higher chance of getting a payout. What techniques sets it apart?
Read More
Related rules
- APT40 Dropbox Tool User Agent
- DNS Query To MEGA Hosting Website
- DNS Query To MEGA Hosting Website - DNS Client
- DNS Query To Ufile.io
- DNS Query To Ufile.io - DNS Client