Windows DNS Client: Queries for Put.io api.put.io or upload.put.io

title: "Windows DNS Client: Queries for Put.io api.put.io or upload.put.io"
id: 9b96d833-f63d-47c7-a88d-90e1d1ff930f
status: test
description: This rule flags Windows DNS Client events where the DNS QueryName contains api.put.io or upload.put.io. Such lookups can indicate attacker infrastructure discovery or use of specific third-party hosting/sharing endpoints. Detection relies on Microsoft-Windows-DNS Client Event Log Operational records (EventID 3008) that include the DNS query name and are collected for the DNS client service.
references:
  - https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/dns_client/win_dns_client_put_io.yml
author: Omar Khaled (@beacon_exe), Huntrule Team
date: 2024-08-23
tags:
  - attack.command-and-control
logsource:
  product: windows
  service: dns-client
  definition: "Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events."
detection:
  selection:
    EventID: 3008
    QueryName|contains:
      - api.put.io
      - upload.put.io
  condition: selection
falsepositives:
  - Legitimate DNS queries and usage of Put.io
level: medium
license: DRL-1.1
related:
  - id: 8b69fd42-9dad-4674-abef-7fdef43ef92a
    type: derived