Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

DNS Query To Put.io - DNS Client

Detects DNS queries for subdomains related to "Put.io" sharing website.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Omar KhaledCreated Fri Aug 238b69fd42-9dad-4674-abef-7fdef43ef92awindows
Log Source
Windowsdns-client
ProductWindows← raw: windows
Servicedns-client← raw: dns-client

Definition

Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        EventID: 3008
        QueryName|contains:
            - 'api.put.io'
            - 'upload.put.io'
    condition: selection
False Positives

Legitimate DNS queries and usage of Put.io

References
1
Resolving title…
darkatlas.io
MITRE ATT&CK
Rule Metadata
Rule ID
8b69fd42-9dad-4674-abef-7fdef43ef92a
Status
test
Level
medium
Type
Detection
Created
Fri Aug 23
Author
Omar Khaled
Path
rules/windows/builtin/dns_client/win_dns_client_put_io.yml
Raw Tags
attack.command-and-control
View on GitHub