Windows DNS Client: DNS queries containing "ufile.io"

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1567.002Exfiltration to Cloud Storage
Impact

What it detects

Identifies DNS Client operational events where the query name contains "ufile.io". Attackers may use this domain as part of data exfiltration infrastructure, so repeated or unexpected lookups warrant investigation. The rule relies on Windows Microsoft-Windows-DNS-Client/Operational telemetry, specifically EventID 3008 and the DNS query name field.

Reporting behind it

Related detections9 linkedT1567.002 — drag to rearrange

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Malicious GhostLocker2 C2 Communication via HTTP POST (via proxy)

Suspicious Rclone Exfiltration Masquerading as wininit.exe

Malicious Bulk Data Exfiltration via Rclone (via process_creation)

Rclone SMB Share Exfiltration

Suspicious Data Exfiltration via Rclone to Cloud Storage (via process_creation)

Malicious Data Exfiltration via MEGAcmd

Suspicious Command and Control via Discord or Telegram Bot API

Data Exfiltration to WebDAV Share via curl Upload

Windows DNS Client: DNS queries containing "ufile.io"

Pivot detection · T1567.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dns-client-detect-dns-queries-containing-ufile-io-090ffaad

title: 'Windows DNS Client: DNS queries containing "ufile.io"'
id: 87701568-a578-491d-8bee-e7e63558ed58
related:
  - id: 1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b
    type: similar
  - id: 090ffaad-c01a-4879-850c-6d57da98452d
    type: derived
status: test
description: Identifies DNS Client operational events where the query name contains "ufile.io". Attackers may use this domain as part of data exfiltration infrastructure, so repeated or unexpected lookups warrant investigation. The rule relies on Windows Microsoft-Windows-DNS-Client/Operational telemetry, specifically EventID 3008 and the DNS query name field.
references:
  - https://thedfirreport.com/2021/12/13/diavol-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/dns_client/win_dns_client_ufile_io.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
modified: 2023-09-18
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  product: windows
  service: dns-client
  definition: "Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events."
detection:
  selection:
    EventID: 3008
    QueryName|contains: ufile.io
  condition: selection
falsepositives:
  - DNS queries for "ufile" are not malicious by nature necessarily. Investigate the source to determine the necessary actions to take
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL