DNS Query To MEGA Hosting Website - DNS Client

Title: DNS Query To MEGA Hosting Website - DNS Client
Status: test
Description:Detects DNS queries for subdomains related to MEGA sharing website
References:
  -https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-16
modified:None
Tags:

• -'attack.exfiltration'
• -'attack.t1567.002'

Logsource:

• product: windows
• service: dns-client
• definition: Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.

Detection:
  selection:
    EventID: '3008'
    QueryName|contains: 'userstorage.mega.co.nz'
  condition:selection
Falsepositives:
  -Legitimate DNS queries and usage of Mega
Level: medium