Network Connection Initiated To Mega.nz

Title: Network Connection Initiated To Mega.nz
Status: test
Description:Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.
References:
  -https://megatools.megous.com/
  -https://www.mandiant.com/resources/russian-targeting-gov-business
Author: Florian Roth (Nextron Systems)
Date: 2021-12-06
modified:2024-05-31
Tags:

• -'attack.exfiltration'
• -'attack.t1567.002'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    Initiated: 'true'
    DestinationHostname|endswith:
      -'mega.co.nz'
      -'mega.nz'

  condition:selection
Falsepositives:
  -Legitimate MEGA installers and utilities are expected to communicate with this domain. Exclude hosts that are known to be allowed to use this tool.
Level: low