Hayabusa medium test sigma

DNS Query To Put.io - DNS Client

Detects DNS queries for subdomains related to "Put.io" sharing website.

View Source

Detection Logic

{
  "dns_client": {
    "Channel": "Microsoft-Windows-DNS Client Events/Operational"
  },
  "selection": {
    "EventID": 3008,
    "QueryName
| contains": [
      "api.put.io",
      "upload.put.io"
    ]
  },
  "condition": "dns_client and selection"
}

False Positives

  • ⚠ Legitimate DNS queries and usage of Put.io

Field Validations

Loading…

Comments (0)

Loading comments...