DNS Query for Anonfiles.com Domain - Sysmon

calendar Dec 1, 2023 · attack.exfiltration attack.t1567.002  ·
Share on: linkedin copy

Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes

Sigma rule (View on GitHub)

 1title: DNS Query for Anonfiles.com Domain - Sysmon
 2id: 065cceea-77ec-4030-9052-fc0affea7110
 3related:
 4    - id: 29f171d7-aa47-42c7-9c7b-3c87938164d9
 5      type: similar
 6status: test
 7description: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes
 8references:
 9    - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
10author: pH-T (Nextron Systems)
11date: 2022/07/15
12modified: 2023/01/16
13tags:
14    - attack.exfiltration
15    - attack.t1567.002
16logsource:
17    product: windows
18    category: dns_query
19detection:
20    selection:
21        QueryName|contains: '.anonfiles.com'
22    condition: selection
23falsepositives:
24    - Rare legitimate access to anonfiles.com
25level: high

References

  • Ransomware Spotlight: BlackByte - Security News

    BlackByte is a ransomware group that has been building a name for itself since 2021. Like its contemporaries, it has gone after critical infrastructure for a higher chance of getting a payout. What techniques sets it apart?


    Read More

Related rules

to-top