Windows DNS Client queries for MEGA userstorage subdomains

Detects Windows DNS client queries for MEGA userstorage subdomains by matching the query name string.

FreeUnreviewedSigmamediumv1

windows-dns-client-queries-for-mega-userstorage-subdomains-66474410

title: Windows DNS Client queries for MEGA userstorage subdomains
id: 6d29f727-ef37-4e4a-93bb-c5f9c19c1ef1
related:
  - id: 613c03ba-0779-4a53-8a1f-47f914a4ded3
    type: similar
  - id: 66474410-b883-415f-9f8d-75345a0a66a6
    type: derived
status: test
description: This rule flags DNS client events where the DNS query name contains the MEGA userstorage domain string. Querying these subdomains can indicate attempts to reach MEGA sharing infrastructure for file access or potential data movement. It relies on Microsoft-Windows-DNS Client Operational events (EventID 3008) that include the queried domain name.
references:
  - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/dns_client/win_dns_client_mega_nz.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  product: windows
  service: dns-client
  definition: "Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events."
detection:
  selection:
    EventID: 3008
    QueryName|contains: userstorage.mega.co.nz
  condition: selection
falsepositives:
  - Legitimate DNS queries and usage of Mega
level: medium
license: DRL-1.1

What it detects

This rule flags DNS client events where the DNS query name contains the MEGA userstorage domain string. Querying these subdomains can indicate attempts to reach MEGA sharing infrastructure for file access or potential data movement. It relies on Microsoft-Windows-DNS Client Operational events (EventID 3008) that include the queried domain name.

Known false positives

Legitimate DNS queries and usage of Mega

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.