[go: up one dir, main page]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Rule: DNS Query To Put.io - DNS Client #4947

Merged
merged 3 commits into from
Aug 23, 2024
Merged

Add Rule: DNS Query To Put.io - DNS Client #4947

merged 3 commits into from
Aug 23, 2024

Conversation

omaramin17
Copy link
Contributor
@omaramin17 omaramin17 commented Aug 3, 2024 •
edited by nasbench

Summary of the Pull Request

This PR adds rules related to detection of communications to put.io that was observed in Medusa Ransomware intrusions

Changelog

new: DNS Query To Put.io - DNS Client

Log Event

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
    <Provider Name='Microsoft-Windows-DNS-Client' Guid='{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}'/>
    <EventID>3008</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime='2024-08-02T21:41:40.7280319Z'/>
    <EventRecordID>991659</EventRecordID>
    <Correlation/>
    <Execution ProcessID='6160' ThreadID='13288'/>
    <Channel>Microsoft-Windows-DNS-Client/Operational</Channel>
    <Computer>Redacted</Computer>
    <Security UserID='Redacted'/>
  </System>
  <EventData>
    <Data Name='QueryName'>upload.put.io</Data>
    <Data Name='QueryType'>1</Data>
    <Data Name='QueryOptions'>32784</Data>
    <Data Name='QueryStatus'>9701</Data>
    <Data Name='QueryResults'></Data>
  </EventData>
</Event>
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
    <Provider Name='Microsoft-Windows-DNS-Client' Guid='Redacted'/>
    <EventID>3008</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime='2024-08-02T21:41:40.7276716Z'/>
    <EventRecordID>991634</EventRecordID>
    <Correlation/>
    <Execution ProcessID='6160' ThreadID='13288'/>
    <Channel>Microsoft-Windows-DNS-Client/Operational</Channel>
    <Computer>Redacted</Computer>
    <Security UserID='S-1-5-18'/>
  </System>
  <EventData>
    <Data Name='QueryName'>api.put.io</Data>
    <Data Name='QueryType'>1</Data>
    <Data Name='QueryOptions'>32784</Data>
    <Data Name='QueryStatus'>9701</Data>
    <Data Name='QueryResults'></Data>
  </EventData>
</Event>

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

@github-actions github-actions bot added Rules Windows Pull request add/update windows related rules labels Aug 3, 2024
github-actions[bot]
github-actions bot reviewed Aug 3, 2024
View reviewed changes
Copy link
Contributor
@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Welcome @omaramin17 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

@nasbench nasbench self-requested a review August 3, 2024 09:35
@nasbench nasbench self-assigned this Aug 3, 2024
@nasbench nasbench added the Work In Progress Some changes are needed label Aug 3, 2024
@nasbench nasbench removed the Work In Progress Some changes are needed label Aug 23, 2024
@nasbench nasbench changed the title Add Rule: dns_query_win_put_io_communications.yml Add Rule: DNS Query To Put.io - DNS Client Aug 23, 2024
@nasbench nasbench merged commit 29dce31 into SigmaHQ:master Aug 23, 2024
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@github-actions GitHub Actions github-actions left review comments

@nasbench nasbench nasbench approved these changes

Assignees

@nasbench nasbench

Labels
Rules Windows Pull request add/update windows related rules
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@omaramin17 @nasbench