win:dns-client
DNS Client events
Channel: Microsoft-Windows-DNS Client Events/Operational
- Host type
- Windows (workstation, member server, domain controller)
- Techniques
- 0
- Rules listed
- 6
- Events
- 2
Techniques
No ATT&CK analytic names this source.
Rules
Sigma 6
- DNS Query To MEGA Hosting Website - DNS Client by Nasreddine Bencherchali (Nextron Systems)
- DNS Query To Put.io - DNS Client by Omar Khaled (@beacon_exe)
- DNS Query To Ufile.io - DNS Client by Nasreddine Bencherchali (Nextron Systems)
- DNS Query for Anonfiles.com Domain - DNS Client by Nasreddine Bencherchali (Nextron Systems)
- Query Tor Onion Address - DNS Client by Nasreddine Bencherchali (Nextron Systems)
- Suspicious Cobalt Strike DNS Beaconing - DNS Client by Nasreddine Bencherchali (Nextron Systems)