Anvilogic critical experimental spl

Process Connection to Mega - Windows [splunk-sysmon]

Mega is a cloud storage service used by many threat actors due to its use of end-to-end encryption and semi-anonymous payment options. The client application MEGAsync.exe and command-line interface utility MegaCMD allow threat actors to exfiltrate large amounts of data. This use case detects network connections involving MEGASync.exe or MegaCMD or network connections to mega.co.nz or mega.nz (Sysmon only).

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=3) 
OR "<EventID>3<") "Megasync.exe" 
OR "megacmd" 
OR "mega.co.nz" 
OR "mega.nz"
| where match(dest_host, "(?i)mega\.(co\.)?nz") or match(process_name, "(?i)mega(sync
| cmd)")
| table _time, host, user, process, process_*, parent_process_*, dest_host
| bin span=300s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...