Windows DNS Client: Detect DNS queries containing "ufile.io"

title: 'Windows DNS Client: Detect DNS queries containing "ufile.io"'
id: 87701568-a578-491d-8bee-e7e63558ed58
related:
  - id: 1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b
    type: similar
  - id: 090ffaad-c01a-4879-850c-6d57da98452d
    type: derived
status: test
description: This rule flags Windows DNS Client events where the DNS query name contains "ufile.io". Attackers may use uncommon domains to support data exfiltration or other malicious infrastructure, making targeted DNS lookups a useful indicator. It relies on Microsoft-Windows-DNS Client events (Operational log) that include EventID 3008 and the queried domain name in QueryName.
references:
  - https://thedfirreport.com/2021/12/13/diavol-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/dns_client/win_dns_client_ufile_io.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
modified: 2023-09-18
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  product: windows
  service: dns-client
  definition: "Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events."
detection:
  selection:
    EventID: 3008
    QueryName|contains: ufile.io
  condition: selection
falsepositives:
  - DNS queries for "ufile" are not malicious by nature necessarily. Investigate the source to determine the necessary actions to take
level: low
license: DRL-1.1