DNS Query for Anonfiles.com Domain - Sysmon

Title: DNS Query for Anonfiles.com Domain - Sysmon
Status: test
Description:Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes
References:
  -https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
Author: pH-T (Nextron Systems)
Date: 2022-07-15
modified:2023-01-16
Tags:

• -'attack.exfiltration'
• -'attack.t1567.002'

Logsource:

• product: windows
• category: dns_query

Detection:
  selection:
    QueryName|contains: '.anonfiles.com'
  condition:selection
Falsepositives:
  -Rare legitimate access to anonfiles.com
Level: high