Sigma high test sigma

DNS Exfiltration and Tunneling Tools Execution

Well-known DNS Exfiltration tools execution

View Source

Detection Logic

{
  "selection": [
    {
      "Image
| endswith": "\\iodine.exe"
    },
    {
      "Image
| contains": "\\dnscat2"
    }
  ],
  "condition": "selection"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...