DNS Query To MEGA Hosting Website

Title: DNS Query To MEGA Hosting Website
Status: test
Description:Detects DNS queries for subdomains related to MEGA sharing website
References:
  -https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
Author: Aaron Greetham (@beardofbinary) - NCC Group
Date: 2021-05-26
modified:2023-09-18
Tags:

• -'attack.exfiltration'
• -'attack.t1567.002'

Logsource:

• product: windows
• category: dns_query

Detection:
  selection:
    QueryName|contains: 'userstorage.mega.co.nz'
  condition:selection
Falsepositives:
  -Legitimate DNS queries and usage of Mega
Level: medium