Windows Network Connections to api.mega.co.nz or mega.nz

title: Windows Network Connections to api.mega.co.nz or mega.nz
id: 87f25834-5cb1-4e78-8220-97b9708b21c7
status: test
description: This rule flags outbound Windows network connections where a process initiates a connection to destinations ending in "mega.co.nz" or "mega.nz". Such connectivity can indicate use of MEGA-style file hosting services to transfer additional payloads during an intrusions or data staging. The detection relies on network connection telemetry that includes whether the connection was initiated and the destination hostname.
references:
  - https://megatools.megous.com/
  - https://www.mandiant.com/resources/russian-targeting-gov-business
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_mega_nz.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-12-06
modified: 2024-05-31
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith:
      - mega.co.nz
      - mega.nz
  condition: selection
falsepositives:
  - Legitimate MEGA installers and utilities are expected to communicate with this domain. Exclude hosts that are known to be allowed to use this tool.
level: low
license: DRL-1.1
related:
  - id: fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4
    type: derived