DNS Query To MEGA Hosting Website

calendar Aug 12, 2024 · attack.exfiltration attack.t1567.002  ·
Share on: linkedin copy

Detects DNS queries for subdomains related to MEGA sharing website

Sigma rule (View on GitHub)

 1title: DNS Query To MEGA Hosting Website
 2id: 613c03ba-0779-4a53-8a1f-47f914a4ded3
 3related:
 4    - id: 66474410-b883-415f-9f8d-75345a0a66a6
 5      type: similar
 6status: test
 7description: Detects DNS queries for subdomains related to MEGA sharing website
 8references:
 9    - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
10author: Aaron Greetham (@beardofbinary) - NCC Group
11date: 2021-05-26
12modified: 2023-09-18
13tags:
14    - attack.exfiltration
15    - attack.t1567.002
16logsource:
17    product: windows
18    category: dns_query
19detection:
20    selection:
21        QueryName|contains: 'userstorage.mega.co.nz'
22    condition: selection
23falsepositives:
24    - Legitimate DNS queries and usage of Mega
25level: medium

References

  • NCC Group’s Cyber Incident Response Team (CIRT) have responded to a large number of ransomware cases where frequently the open source tool Rclone being used for data exfiltration. Rclone provides a...


    Read More

Related rules

to-top