DNS Query for Anonfiles.com Domain - DNS Client

Title: DNS Query for Anonfiles.com Domain - DNS Client
Status: test
Description:Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes
References:
  -https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-16
modified:None
Tags:

• -'attack.exfiltration'
• -'attack.t1567.002'

Logsource:

• product: windows
• service: dns-client
• definition: Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.

Detection:
  selection:
    EventID: '3008'
    QueryName|contains: '.anonfiles.com'
  condition:selection
Falsepositives:
  -Rare legitimate access to anonfiles.com
Level: high