Detectionmediumtest

DNS Query To MEGA Hosting Website - DNS Client

Detects DNS queries for subdomains related to MEGA sharing website

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Mon Jan 1666474410-b883-415f-9f8d-75345a0a66a6windows

Log Source

Windowsdns-client

ProductWindows← raw: windows

Servicedns-client← raw: dns-client

Definition

Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.

Detection Logic

detection:
    selection:
        EventID: 3008
        QueryName|contains: 'userstorage.mega.co.nz'
    condition: selection

False Positives

Legitimate DNS queries and usage of Mega

References

MITRE ATT&CK

Tactics

Sub-techniques

Related Rules

DNS Query To MEGA Hosting Website

Detects DNS queries for subdomains related to MEGA sharing website

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

66474410-b883-415f-9f8d-75345a0a66a6

Status

test

Level

medium

Type

Detection

Created

Mon Jan 16

Author

Path

rules/windows/builtin/dns_client/win_dns_client_mega_nz.yml

Raw Tags

attack.exfiltrationattack.t1567.002