Windows DNS Client: DNS query for anonfiles.com domain

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1567.002Exfiltration to Cloud Storage
Impact

What it detects

This rule identifies DNS client activity where the DNS query name contains the .anonfiles.com domain. Attackers may use file-hosting services to move or stage data, and matching DNS queries helps surface potential infrastructure and exfiltration-related communication. It relies on Microsoft-Windows-DNS Client operational event telemetry, specifically events with EventID 3008 and a matching query name substring.

Reporting behind it

Related detections9 linkedT1567.002 — drag to rearrange

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Malicious GhostLocker2 C2 Communication via HTTP POST (via proxy)

Suspicious Rclone Exfiltration Masquerading as wininit.exe

Malicious Bulk Data Exfiltration via Rclone (via process_creation)

Rclone SMB Share Exfiltration

Suspicious Data Exfiltration via Rclone to Cloud Storage (via process_creation)

Malicious Data Exfiltration via MEGAcmd

Suspicious Command and Control via Discord or Telegram Bot API

Data Exfiltration to WebDAV Share via curl Upload

Windows DNS Client: DNS query for anonfiles.com domain

Pivot detection · T1567.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dns-client-queryname-contains-anonfiles-com-29f171d7

title: "Windows DNS Client: DNS query for anonfiles.com domain"
id: 51dec21f-80a9-4fc6-b0de-5974a1f57c11
related:
  - id: 065cceea-77ec-4030-9052-fc0affea7110
    type: similar
  - id: 29f171d7-aa47-42c7-9c7b-3c87938164d9
    type: derived
status: test
description: This rule identifies DNS client activity where the DNS query name contains the .anonfiles.com domain. Attackers may use file-hosting services to move or stage data, and matching DNS queries helps surface potential infrastructure and exfiltration-related communication. It relies on Microsoft-Windows-DNS Client operational event telemetry, specifically events with EventID 3008 and a matching query name substring.
references:
  - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/dns_client/win_dns_client_anonymfiles_com.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  product: windows
  service: dns-client
  definition: "Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events."
detection:
  selection:
    EventID: 3008
    QueryName|contains: .anonfiles.com
  condition: selection
falsepositives:
  - Rare legitimate access to anonfiles.com
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL