Title:
DNS Query To Ufile.io - DNS Client
Status:
test
Description:Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
References:
-https://thedfirreport.com/2021/12/13/diavol-ransomware/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-16
modified:2023-09-18
Tags:
- -'attack.exfiltration'
- -'attack.t1567.002'
Logsource:
- product: windows
- service: dns-client
- definition: Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.
Detection:
selection:
EventID:
'3008'
QueryName|contains:
'ufile.io'
condition:
selection
Falsepositives:
-DNS queries for "ufile" are not malicious by nature necessarily. Investigate the source to determine the necessary actions to take
Level:
low
