DNS Query To Ufile.io - Data Exfiltration

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•25

Detects DNS queries to "ufile.io", which has been observed as a method for data exfiltration by malware and threat actors. This rule specifically looks for Event ID 3008 in the Microsoft-Windows-DNS Client Events/Operational log where the QueryName contains 'ufile.io'.