Windows Sysmon DNS Query for anonfiles.com Domain

Flags Windows Sysmon DNS queries referencing anonfiles.com to support detection of suspicious data staging.

FreeUnreviewedSigmahighv1

windows-sysmon-dns-query-for-anonfiles-com-domain-065cceea

title: Windows Sysmon DNS Query for anonfiles.com Domain
id: 968ee27e-dcb1-49ad-be2b-5f201268ff80
related:
  - id: 29f171d7-aa47-42c7-9c7b-3c87938164d9
    type: similar
  - id: 065cceea-77ec-4030-9052-fc0affea7110
    type: derived
status: test
description: This rule flags DNS queries whose query name contains ".anonfiles.com" in Windows telemetry from Sysmon. Attackers may use anonymous file-sharing domains to stage, host, or exchange data, making domain-specific DNS activity a useful indicator. The detection relies on DNS query logging that includes QueryName.
references:
  - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_anonymfiles_com.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2022-07-15
modified: 2023-01-16
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|contains: .anonfiles.com
  condition: selection
falsepositives:
  - Rare legitimate access to anonfiles.com
level: high
license: DRL-1.1

What it detects

This rule flags DNS queries whose query name contains ".anonfiles.com" in Windows telemetry from Sysmon. Attackers may use anonymous file-sharing domains to stage, host, or exchange data, making domain-specific DNS activity a useful indicator. The detection relies on DNS query logging that includes QueryName.

Known false positives

Rare legitimate access to anonfiles.com

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.