Query: detect Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes in logs
Matching passage: Sigma rule: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes. Logsource: windows / dns_query. Rule: title: DNS Query for Anonfiles.com Domain - Sysmon id: 065cceea-77ec-4030-9052-fc0affea7110 related: - id: 29f171d7-aa47-42c7-9c7b-3c87938164d9 type: similar status: test description: Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes references: - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte author: pH-T (Nextron Systems) date: 2022-07-15 modified: 2023-01-16 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: .anonfiles.com condition: selection falsepositives: - Rare legitimate access to anonfiles.com level: high
Near-miss passage: Sigma rule: Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter). Logsource: windows / process_creation. Rule: title: Suspicious SYSTEM User Process Creation id: 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09 status: test description: Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter) references: - Internal Research - https://tools.thehacker.recipes/mimikatz/modules author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) date: 2021-12-20 modified: 2025-10-19 tags: - attack.credential-access - attack.privilege-escalation - attack.stealth - attack.t1134 - attack.t1003 - attack.t1027 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - System - S-1-16-16384 User|contains: - AUTHORI - AUTORI selection_special: - Image|endswith: - \calc.exe - \cscript.exe - \forfiles.exe - \hh.exe - \mshta.exe - \ping.exe - \wscript.exe - CommandLine|re: net\s+user\s+ - CommandLine|contains: - ' -NoP ' - ' -W Hidden ' - ' -decode ' - ' /decode ' - ' /urlcache ' - ' -urlcache ' - ' -e* JAB' - ' -e* SUVYI' - ' -e* SQBFAFgA' - ' -e* aWV4I' - ' -e* IAB' - ' -e* PAA' - ' -e* aQBlAHgA' - vssadmin delete shadows - reg SAVE HKLM - ' -ma ' - Microsoft\Windows\CurrentVersion\Run - .downloadstring( - .downloadfile( - ' /ticket:' - 'dpapi::' - event::clear - event::drop - id::modify - 'kerberos::' - 'lsadump::' - 'misc::' - 'privilege::' - 'rpc::' - 'sekurlsa::' - 'sid::' - 'token::' - vault::cred - vault::list - ' p::d ' - ;iex( - MiniDump filter_main_ping: CommandLine|contains|all: - ping - 127.0.0.1 - ' -n ' filter_vs: Image|endswith: \PING.EXE ParentCommandLine|contains: \DismFoDInstall.cmd filter_config_mgr: ParentImage|contains: :\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ filter_java: ParentImage|contains: - :\Program Files (x86)\Java\ - :\Program Files\Java\ ParentImage|endswith: \bin\javaws.exe Image|contains: - :\Program Files (x86)\Java\ - :\Program Files\Java\ Image|endswith: \bin\jp2launcher.exe CommandLine|contains: ' -ma ' condition: all of selection* and not 1 of filter_* falsepositives: - Administrative activity - Scripts and administrative tools used in the monitored environment - Monitoring activity level: high