Windows DNS Query for MEGA userstorage subdomains

Alerts on DNS queries referencing MEGA userstorage subdomains from Windows hosts.

FreeUnreviewedSigmamediumv1

windows-dns-query-for-mega-userstorage-subdomains-613c03ba

title: Windows DNS Query for MEGA userstorage subdomains
id: b59fd07b-d82c-4b15-b551-b9538f6485fe
related:
  - id: 66474410-b883-415f-9f8d-75345a0a66a6
    type: similar
  - id: 613c03ba-0779-4a53-8a1f-47f914a4ded3
    type: derived
status: test
description: This rule flags DNS queries where the queried name contains the MEGA userstorage domain suffix. Attackers may use well-known web hosting or file-sharing services to support data staging or exfiltration, making these DNS lookups a useful early signal. The detection relies on Windows DNS query telemetry, specifically the queried name field.
references:
  - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_mega_nz.yml
author: Aaron Greetham (@beardofbinary) - NCC Group, Huntrule Team
date: 2021-05-26
modified: 2023-09-18
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|contains: userstorage.mega.co.nz
  condition: selection
falsepositives:
  - Legitimate DNS queries and usage of Mega
level: medium
license: DRL-1.1

What it detects

This rule flags DNS queries where the queried name contains the MEGA userstorage domain suffix. Attackers may use well-known web hosting or file-sharing services to support data staging or exfiltration, making these DNS lookups a useful early signal. The detection relies on Windows DNS query telemetry, specifically the queried name field.

Known false positives

Legitimate DNS queries and usage of Mega

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.