Detection rules › Sigma

DNS Query for Anonfiles.com Domain - DNS Client

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

MITRE ATT&CK coverage

TacticTechniques
ExfiltrationT1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Event coverage

ProviderEvent IDTitle
DNS-Client3008DNS query is completed for the name QueryName, type QueryType, query options QueryOptions with status QueryStatus Results QueryResults.

Stages and Predicates

Stage 1: selection

QueryName|contains: .anonfiles.com

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
QueryNamematch
  • .anonfiles.com corpus 2 (sigma 2)

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.