Windows DNS Queries Containing ufile.io

Alerts on Windows DNS lookups where the queried name contains ufile.io, indicating potential exfiltration-related activity.

FreeUnreviewedSigmalowv1

windows-dns-queries-containing-ufile-io-1cbbeaaf

title: Windows DNS Queries Containing ufile.io
id: a7cb8618-51c1-46cb-aa62-6bd5551e4b8f
related:
  - id: 090ffaad-c01a-4879-850c-6d57da98452d
    type: similar
  - id: 1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b
    type: derived
status: test
description: This rule flags DNS query events on Windows where the queried name contains "ufile.io". Querying this domain is relevant to data exfiltration activity because it has been observed being used to support malware communications. The detection relies on DNS query telemetry that records the queried name (QueryName) and matches substrings containing "ufile.io".
references:
  - https://thedfirreport.com/2021/12/13/diavol-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_ufile_io_query.yml
author: yatinwad, TheDFIRReport, Huntrule Team
date: 2022-06-23
modified: 2023-09-18
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|contains: ufile.io
  condition: selection
falsepositives:
  - DNS queries for "ufile" are not malicious by nature necessarily. Investigate the source to determine the necessary actions to take
level: low
license: DRL-1.1

What it detects

This rule flags DNS query events on Windows where the queried name contains "ufile.io". Querying this domain is relevant to data exfiltration activity because it has been observed being used to support malware communications. The detection relies on DNS query telemetry that records the queried name (QueryName) and matches substrings containing "ufile.io".

Known false positives

DNS queries for "ufile" are not malicious by nature necessarily. Investigate the source to determine the necessary actions to take

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.