Windows DNS Client: MEGA userstorage subdomain DNS query (EventID 3008)

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1567.002Exfiltration to Cloud Storage
Impact

What it detects

This rule flags Windows DNS client events where a DNS query name contains the MEGA userstorage.mega.co.nz domain. Attackers may use MEGA-hosted domains to stage or move data, making DNS activity a useful early indicator of potential exfiltration-related behavior. The detection relies on Microsoft-Windows-DNS Client operational telemetry, specifically EventID 3008 and the queried domain name string.

Reporting behind it

Related detections9 linkedT1567.002 — drag to rearrange

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Malicious GhostLocker2 C2 Communication via HTTP POST (via proxy)

Suspicious Rclone Exfiltration Masquerading as wininit.exe

Malicious Bulk Data Exfiltration via Rclone (via process_creation)

Rclone SMB Share Exfiltration

Suspicious Data Exfiltration via Rclone to Cloud Storage (via process_creation)

Malicious Data Exfiltration via MEGAcmd

Suspicious Command and Control via Discord or Telegram Bot API

Data Exfiltration to WebDAV Share via curl Upload

Windows DNS Client: MEGA userstorage subdomain DNS query (EventID 3008)

Pivot detection · T1567.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dns-client-queries-for-mega-userstorage-subdomains-66474410

title: "Windows DNS Client: MEGA userstorage subdomain DNS query (EventID 3008)"
id: 6d29f727-ef37-4e4a-93bb-c5f9c19c1ef1
related:
  - id: 613c03ba-0779-4a53-8a1f-47f914a4ded3
    type: similar
  - id: 66474410-b883-415f-9f8d-75345a0a66a6
    type: derived
status: test
description: This rule flags Windows DNS client events where a DNS query name contains the MEGA userstorage.mega.co.nz domain. Attackers may use MEGA-hosted domains to stage or move data, making DNS activity a useful early indicator of potential exfiltration-related behavior. The detection relies on Microsoft-Windows-DNS Client operational telemetry, specifically EventID 3008 and the queried domain name string.
references:
  - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/dns_client/win_dns_client_mega_nz.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  product: windows
  service: dns-client
  definition: "Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events."
detection:
  selection:
    EventID: 3008
    QueryName|contains: userstorage.mega.co.nz
  condition: selection
falsepositives:
  - Legitimate DNS queries and usage of Mega
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL