Detectionhightest

DNS Query for Anonfiles.com Domain - Sysmon

Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Martin MuellerCreated Fri Jul 15Updated Mon Jan 16065cceea-77ec-4030-9052-fc0affea7110windows

Log Source

WindowsDNS Query

ProductWindows← raw: windows

CategoryDNS Query← raw: dns_query

DNS lookup events generated by endpoint monitoring tools.

Detection Logic

detection:
    selection:
        QueryName|contains: '.anonfiles.com'
    condition: selection

False Positives

Rare legitimate access to anonfiles.com

References

MITRE ATT&CK

Tactics

Sub-techniques

Related Rules

DNS Query for Anonfiles.com Domain - DNS Client

Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

065cceea-77ec-4030-9052-fc0affea7110

Status

test

Level

high

Type

Detection

Created

Fri Jul 15

Modified

Mon Jan 16

Author

Path

rules/windows/dns_query/dns_query_win_anonymfiles_com.yml

Raw Tags

attack.exfiltrationattack.t1567.002