Windows DNS Client: QueryName contains .anonfiles.com

Alerts when Windows DNS client logs show a DNS query containing .anonfiles.com.

FreeUnreviewedSigmahighv1

windows-dns-client-queryname-contains-anonfiles-com-29f171d7

title: "Windows DNS Client: QueryName contains .anonfiles.com"
id: 51dec21f-80a9-4fc6-b0de-5974a1f57c11
related:
  - id: 065cceea-77ec-4030-9052-fc0affea7110
    type: similar
  - id: 29f171d7-aa47-42c7-9c7b-3c87938164d9
    type: derived
status: test
description: This rule flags Windows DNS client events where the DNS query name includes .anonfiles.com. Attackers may use domains like this to reach anonymity-focused services that can support malicious staging or exfiltration. Detection relies on Microsoft-Windows-DNS Client operational telemetry, specifically DNS client event records with EventID 3008 and the QueryName field.
references:
  - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/dns_client/win_dns_client_anonymfiles_com.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  product: windows
  service: dns-client
  definition: "Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events."
detection:
  selection:
    EventID: 3008
    QueryName|contains: .anonfiles.com
  condition: selection
falsepositives:
  - Rare legitimate access to anonfiles.com
level: high
license: DRL-1.1

What it detects

This rule flags Windows DNS client events where the DNS query name includes .anonfiles.com. Attackers may use domains like this to reach anonymity-focused services that can support malicious staging or exfiltration. Detection relies on Microsoft-Windows-DNS Client operational telemetry, specifically DNS client event records with EventID 3008 and the QueryName field.

Known false positives

Rare legitimate access to anonfiles.com

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.