Windows: Network connections initiated to api.mega.co.nz or mega.nz

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1567.002Exfiltration to Cloud Storage
Impact

What it detects

This rule identifies outbound network connections marked as initiated by a Windows process to domains ending with mega.co.nz or mega.nz. Such connectivity can be abused by attackers to access file-sharing infrastructure for staging, exchanging, or retrieving payloads. It relies on network connection telemetry that includes an initiated flag and destination hostname to match the specified domain suffixes.

Reporting behind it

Related detections9 linkedT1567.002 — drag to rearrange

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Malicious GhostLocker2 C2 Communication via HTTP POST (via proxy)

Suspicious Rclone Exfiltration Masquerading as wininit.exe

Malicious Bulk Data Exfiltration via Rclone (via process_creation)

Rclone SMB Share Exfiltration

Suspicious Data Exfiltration via Rclone to Cloud Storage (via process_creation)

Malicious Data Exfiltration via MEGAcmd

Suspicious Command and Control via Discord or Telegram Bot API

Data Exfiltration to WebDAV Share via curl Upload

Windows: Network connections initiated to api.mega.co.nz or mega.nz

Pivot detection · T1567.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-network-connections-to-api-mega-co-nz-or-mega-nz-fdeebdf0

title: "Windows: Network connections initiated to api.mega.co.nz or mega.nz"
id: 87f25834-5cb1-4e78-8220-97b9708b21c7
status: test
description: This rule identifies outbound network connections marked as initiated by a Windows process to domains ending with mega.co.nz or mega.nz. Such connectivity can be abused by attackers to access file-sharing infrastructure for staging, exchanging, or retrieving payloads. It relies on network connection telemetry that includes an initiated flag and destination hostname to match the specified domain suffixes.
references:
  - https://megatools.megous.com/
  - https://www.mandiant.com/resources/russian-targeting-gov-business
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_mega_nz.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-12-06
modified: 2024-05-31
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith:
      - mega.co.nz
      - mega.nz
  condition: selection
falsepositives:
  - Legitimate MEGA installers and utilities are expected to communicate with this domain. Exclude hosts that are known to be allowed to use this tool.
level: low
license: DRL-1.1
related:
  - id: fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL