Hayabusa medium test sigma

DNS Query To MEGA Hosting Website - DNS Client

Detects DNS queries for subdomains related to MEGA sharing website

View Source

Detection Logic

{
  "dns_client": {
    "Channel": "Microsoft-Windows-DNS Client Events/Operational"
  },
  "selection": {
    "EventID": 3008,
    "QueryName
| contains": "userstorage.mega.co.nz"
  },
  "condition": "dns_client and selection"
}

False Positives

  • ⚠ Legitimate DNS queries and usage of Mega

Field Validations

Loading…

Comments (0)

Loading comments...