Non-browser process resolving a file-sharing or paste service

1title: Non-browser process resolving a file-sharing or paste service2id: bb7e9b72-d184-4c7b-a32a-fb3816d1c7d03status: experimental4description: |5  What separates this technique from exfiltration over a raw channel is the6  identity of the destination service, and the DNS query is the only log source7  in AN1511 that carries that identity on a single event — so this rule pins8  `QueryName` to file-sharing, paste, messaging-API and cloud-storage-API9  domains and `Image` to the script hosts, signed-binary proxies, transfer10  utilities and Office applications the analytic calls out as processes that do11  not normally initiate network communications. Both lists are assembled here;12  MITRE supplies the `MonitoredServices` knob and not its contents, and the13  provider list is a dated starting point — services come and go (anonfiles14  closed in 2023) and a site should replace it with the providers it has not15  sanctioned. The programmatic hostnames are included deliberately, because16  business-tenant exfiltration with a stolen token resolves17  `www.googleapis.com`, `graph.microsoft.com` or a tenant SharePoint host18  rather than the consumer names — on an M365 or Workspace estate those three19  match constantly and are the first entries to cut. Scope: every provider20  named here belongs to a child technique — cloud storage to T1567.002, paste21  sites to T1567.003, the Telegram and Discord webhook endpoints to T1567.004,22  all tagged below — and the parent-level behaviours that do not reduce to a23  named provider are out of scope for this rule. The analytic's real24  discriminator is the outbound-to-inbound volume ratio over a `TimeWindow`,25  and Sigma has neither aggregation nor a numeric threshold, so this fires on26  one name resolution instead; a resolution is not a transfer and carries no27  direction, so a download and an upload are identical here, a tool that hands28  its transport to a service process resolves nothing under its own name, and29  the rule sees nothing at all unless the running Sysmon configuration is30  version 10 or later with DNS query logging enabled and not filtered out.31  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0548, not hand-written and not tested by its author. Any lab result is on this rule's own page.32references:33  - https://attack.mitre.org/techniques/T156734  - https://attack.mitre.org/detectionstrategies/DET054835author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)36date: 2026-08-1637tags:38  - attack.exfiltration39  - attack.t156740  - attack.t1567.00241  - attack.t1567.00342  - attack.t1567.00443logsource:44  category: dns_query45  product: windows46detection:47  selection_service:48    QueryName|endswith:49      - 'dropbox.com'50      - 'dropboxapi.com'51      - 'drive.google.com'52      - 'www.googleapis.com'53      - 'oauth2.googleapis.com'54      - 'onedrive.live.com'55      - 'api.onedrive.com'56      - 'graph.microsoft.com'57      - 'sharepoint.com'58      - 'mega.nz'59      - 'mega.co.nz'60      - 'wetransfer.com'61      - 'transfer.sh'62      - 'file.io'63      - 'gofile.io'64      - 'pastebin.com'65      - 'hastebin.com'66      - 'paste.ee'67      - 'api.telegram.org'68      - 'discord.com'69      - 'discordapp.com'70  selection_process:71    Image|endswith:72      - '\powershell.exe'73      - '\pwsh.exe'74      - '\wscript.exe'75      - '\cscript.exe'76      - '\mshta.exe'77      - '\rundll32.exe'78      - '\regsvr32.exe'79      - '\certutil.exe'80      - '\curl.exe'81      - '\python.exe'82      - '\pythonw.exe'83      - '\rclone.exe'84      - '\winword.exe'85      - '\excel.exe'86      - '\powerpnt.exe'87  condition: selection_service and selection_process88falsepositives:89  - "Business-tenant API endpoints. On an M365 or Google Workspace estate, Word and Excel reach graph.microsoft.com and the tenant sharepoint.com host for AutoSave, co-authoring and add-ins, and PowerShell modules such as Microsoft.Graph do the same on every run — this is the highest-volume match by a wide margin, which is why the level is set no higher than low, and MITRE's MonitoredServices knob is where the tenant's own hostnames get removed rather than baselined."90  - "Sanctioned consumer cloud storage, which is ubiquitous wherever personal OneDrive, Google Drive or Dropbox accounts are attached to managed machines: Office applications and PowerShell scripts then resolve those endpoints continuously as ordinary document work."91  - "Administrator and developer downloads. A download and an upload are the same DNS event, so winget and Chocolatey bootstraps, an iwr of an install.ps1, and curl.exe or certutil.exe pulling tooling or snippets from gofile.io, transfer.sh or pastebin.com all match exactly as an upload would."92  - "Backup, sync and migration jobs built on rclone, curl or Python that push to a corporate cloud account on a schedule, which are indistinguishable from staged exfiltration at the DNS layer because the volume element of the analytic is not expressible here."93  - "IT automation that posts job results to chat, where a scheduled PowerShell or Python task resolves api.telegram.org or discord.com on every run to reach a bot or webhook used for alerting."94level: low