Windows DNS Client detects queries to Put.io subdomains (api.put.io, upload.put.io)
Alert on Windows DNS Client queries containing api.put.io or upload.put.io.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Service
- dns-client
- Author
- Omar Khaled (@beacon_exe) (SigmaHQ), DRL 1.1
- Published
- 2024-08-23
- Updated
- 2026-07-31
What it detects
This rule flags Windows DNS client activity where the resolver queries DNS names containing specific Put.io subdomains (api.put.io and upload.put.io). Attackers may use these domains for data exchange or to blend outbound traffic with legitimate services. The detection relies on Microsoft-Windows-DNS Client Events/Operational event telemetry, specifically EventID 3008 with the queried name captured as QueryName.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-dns-client-queries-for-put-io-api-put-io-or-upload-put-io-8b69fd42
title: Windows DNS Client detects queries to Put.io subdomains (api.put.io, upload.put.io)
id: 9b96d833-f63d-47c7-a88d-90e1d1ff930f
status: test
description: This rule flags Windows DNS client activity where the resolver queries DNS names containing specific Put.io subdomains (api.put.io and upload.put.io). Attackers may use these domains for data exchange or to blend outbound traffic with legitimate services. The detection relies on Microsoft-Windows-DNS Client Events/Operational event telemetry, specifically EventID 3008 with the queried name captured as QueryName.
references:
- https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/dns_client/win_dns_client_put_io.yml
author: Omar Khaled (@beacon_exe), Huntrule Team
date: 2024-08-23
tags:
- attack.command-and-control
logsource:
product: windows
service: dns-client
definition: "Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events."
detection:
selection:
EventID: 3008
QueryName|contains:
- api.put.io
- upload.put.io
condition: selection
falsepositives:
- Legitimate DNS queries and usage of Put.io
level: medium
license: DRL-1.1
related:
- id: 8b69fd42-9dad-4674-abef-7fdef43ef92a
type: derived