Non-browser process resolving a file-sharing or paste service

Siemphony@siemphonylowT1567+3unverified

What separates this technique from exfiltration over a raw channel is the identity of the destination service, and the DNS query is the only log source in AN1511 that carries that identity on a single event — so this rule pins `QueryName` to file-sharing, paste, messaging-API and cloud-storage-API domains and `Image` to the script hosts, signed-binary proxies, transfer utilities and Office applications the analytic calls out as processes that do not normally initiate network communications. Both lists are assembled here; MITRE supplies the `MonitoredServices` knob and not its contents, and the provider list is a dated starting point — services come and go (anonfiles closed in 2023) and a site should replace it with the providers it has not sanctioned. The programmatic hostnames are included deliberately, because business-tenant exfiltration with a stolen token resolves `www.googleapis.com`, `graph.microsoft.com` or a tenant SharePoint host rather than the consumer names — on an M365 or Workspace estate those three match constantly and are the first entries to cut. Scope: every provider named here belongs to a child technique — cloud storage to T1567.002, paste sites to T1567.003, the Telegram and Discord webhook endpoints to T1567.004, all tagged below — and the parent-level behaviours that do not reduce to a named provider are out of scope for this rule. The analytic's real discriminator is the outbound-to-inbound volume ratio over a `TimeWindow`, and Sigma has neither aggregation nor a numeric threshold, so this fires on one name resolution instead; a resolution is not a transfer and carries no direction, so a download and an upload are identical here, a tool that hands its transport to a service process resolves nothing under its own name, and the rule sees nothing at all unless the running Sysmon configuration is version 10 or later with DNS query logging enabled and not filtered out. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0548, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((QueryName="*dropbox.com" OR QueryName="*dropboxapi.com" OR QueryName="*drive.google.com" OR QueryName="*www.googleapis.com" OR QueryName="*oauth2.googleapis.com" OR QueryName="*onedrive.live.com" OR QueryName="*api.onedrive.com" OR QueryName="*graph.microsoft.com" OR QueryName="*sharepoint.com" OR QueryName="*mega.nz" OR QueryName="*mega.co.nz" OR QueryName="*wetransfer.com" OR QueryName="*transfer.sh" OR QueryName="*file.io" OR QueryName="*gofile.io" OR QueryName="*pastebin.com" OR QueryName="*hastebin.com" OR QueryName="*paste.ee" OR QueryName="*api.telegram.org" OR QueryName="*discord.com" OR QueryName="*discordapp.com") AND (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe" OR Image="*\\certutil.exe" OR Image="*\\curl.exe" OR Image="*\\python.exe" OR Image="*\\pythonw.exe" OR Image="*\\rclone.exe" OR Image="*\\winword.exe" OR Image="*\\excel.exe" OR Image="*\\powerpnt.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(dns.question.name) LIKE "*dropbox.com" OR TO_LOWER(dns.question.name) LIKE "*dropboxapi.com" OR TO_LOWER(dns.question.name) LIKE "*drive.google.com" OR TO_LOWER(dns.question.name) LIKE "*www.googleapis.com" OR TO_LOWER(dns.question.name) LIKE "*oauth2.googleapis.com" OR TO_LOWER(dns.question.name) LIKE "*onedrive.live.com" OR TO_LOWER(dns.question.name) LIKE "*api.onedrive.com" OR TO_LOWER(dns.question.name) LIKE "*graph.microsoft.com" OR TO_LOWER(dns.question.name) LIKE "*sharepoint.com" OR TO_LOWER(dns.question.name) LIKE "*mega.nz" OR TO_LOWER(dns.question.name) LIKE "*mega.co.nz" OR TO_LOWER(dns.question.name) LIKE "*wetransfer.com" OR TO_LOWER(dns.question.name) LIKE "*transfer.sh" OR TO_LOWER(dns.question.name) LIKE "*file.io" OR TO_LOWER(dns.question.name) LIKE "*gofile.io" OR TO_LOWER(dns.question.name) LIKE "*pastebin.com" OR TO_LOWER(dns.question.name) LIKE "*hastebin.com" OR TO_LOWER(dns.question.name) LIKE "*paste.ee" OR TO_LOWER(dns.question.name) LIKE "*api.telegram.org" OR TO_LOWER(dns.question.name) LIKE "*discord.com" OR TO_LOWER(dns.question.name) LIKE "*discordapp.com") AND (TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\python.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pythonw.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rclone.exe" OR TO_LOWER(process.executable) LIKE "*\\\\winword.exe" OR TO_LOWER(process.executable) LIKE "*\\\\excel.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powerpnt.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,dns_query,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="QueryName" type="pcre2">(?i)(dropbox\.com$|dropboxapi\.com$|drive\.google\.com$|www\.googleapis\.com$|oauth2\.googleapis\.com$|onedrive\.live\.com$|api\.onedrive\.com$|graph\.microsoft\.com$|sharepoint\.com$|mega\.nz$|mega\.co\.nz$|wetransfer\.com$|transfer\.sh$|file\.io$|gofile\.io$|pastebin\.com$|hastebin\.com$|paste\.ee$|api\.telegram\.org$|discord\.com$|discordapp\.com$)</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$|\\certutil\.exe$|\\curl\.exe$|\\python\.exe$|\\pythonw\.exe$|\\rclone\.exe$|\\winword\.exe$|\\excel\.exe$|\\powerpnt\.exe$)</field>    <description>Non-browser process resolving a file-sharing or paste service</description>    <mitre>      <id>T1567</id>      <id>T1567.002</id>      <id>T1567.003</id>      <id>T1567.004</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"dns_query","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: dns_query / windows
Level: low
Category: data_staging_exfil
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: bb7e9b72-d184-4c7b-a32a-fb3816d1c7d0

ATT&CKT1567 +3

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfil

01 · What this rule detects

Collection before departure: files gathered from profiles and shares, compressed — often into a password-protected archive — dropped into a staging directory, and then moved out of the environment. The staging half is the reliably detectable half, and it usually happens close enough to the transfer that catching it still leaves time to act.

02 · Telemetry you need

Process creation with full command lines for archiving utilities — 7z, rar, WinRAR's console build, tar.exe, makecab, and PowerShell Compress-Archive; the switches are the interesting part, so a truncated command line is worthless here
Sysmon EventID 11 (FileCreate) for archive extensions written under Temp, ProgramData, Public and the recycle bin
Sysmon EventID 3 (NetworkConnect) with DestinationIp, DestinationHostname, DestinationPort and Initiated, tied to the uploading process
Proxy, firewall or flow logs with bytes sent per session — these are the only records that carry volume and direction, and neither Sysmon nor the Security log has them
Security 5145 (detailed file share access) and 4663 (object access) for reads across shares — 5145 requires Audit Detailed File Share, 4663 requires Audit Object Access plus a SACL on the data itself, and all of it is off by default
DNS query logs, for the cloud storage and tunnelling destinations the transfer half resolves

03 · How the logic works

Split this into two rules, because it is really two behaviours with different telemetry. The staging rule is a process rule: an archiving utility invoked with a recursion switch, an output path under a staging directory, or a password flag, over a source path that holds user data or share content. Anchor on the switches and the paths rather than the tool name — a renamed rar.exe still needs the same arguments to do the same job — and keep the password flag as its own higher-severity condition, since ordinary backup rarely needs one. The transfer rule is a volume and destination rule, and it does not express well in Sigma: there is no aggregation, so the bytes-sent threshold and the per-destination grouping live in the backend query or the correlation layer. The pairing that makes both worth having is sequence — an archive created, then that same file opened by a process that immediately connects outbound.

04 · Common false positives

Backup and archiving agents doing precisely this by design, including Veeam, Acronis and Windows Server Backup
Sanctioned cloud sync clients — OneDrive, Dropbox, Box — moving large volumes to destinations that are supposed to receive them
Developers and build agents compressing source trees, artefacts and logs, and CI runners uploading them
IT collecting diagnostic bundles and log archives for a vendor support case
E-discovery, DLP and data-classification scanners reading broadly across shares, and migration tooling moving mailboxes or file servers

05 · Detection maturity

Tier 1 — starting point: Matches archiving utility command lines by tool name.
Tier 2 — tuned: Matches recursion and password switches over sensitive source paths, with backup and sync clients excluded by signed path.
Tier 3 — correlated: Correlates archive creation with the subsequent read and outbound transfer of that file, scored on destination novelty and volume.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Password-protected archives of user data are the highest-payoff single condition in this category; alert on those before anything else
Scope the staging rule by source path — profile directories and file shares — rather than by the utility, so unfamiliar tools still match
Exclude sanctioned cloud sync by the signed path of the client process, not by destination domain, or you excuse anything that can reach the same domain
Keep staging and transfer as separate alerts so each stays actionable, and correlate them for severity rather than merging them into one rule
Where the archive is written matters more than what wrote it: a user-writable staging directory holding an archive of someone else's data is the shape you are looking for

Declared by the author

Business-tenant API endpoints. On an M365 or Google Workspace estate, Word and Excel reach graph.microsoft.com and the tenant sharepoint.com host for AutoSave, co-authoring and add-ins, and PowerShell modules such as Microsoft.Graph do the same on every run — this is the highest-volume match by a wide margin, which is why the level is set no higher than low, and MITRE's MonitoredServices knob is where the tenant's own hostnames get removed rather than baselined.
Sanctioned consumer cloud storage, which is ubiquitous wherever personal OneDrive, Google Drive or Dropbox accounts are attached to managed machines: Office applications and PowerShell scripts then resolve those endpoints continuously as ordinary document work.
Administrator and developer downloads. A download and an upload are the same DNS event, so winget and Chocolatey bootstraps, an iwr of an install.ps1, and curl.exe or certutil.exe pulling tooling or snippets from gofile.io, transfer.sh or pastebin.com all match exactly as an upload would.
Backup, sync and migration jobs built on rclone, curl or Python that push to a corporate cloud account on a schedule, which are indistinguishable from staged exfiltration at the DNS layer because the volume element of the analytic is not expressible here.
IT automation that posts job results to chat, where a scheduled PowerShell or Python task resolves api.telegram.org or discord.com on every run to reach a bot or webhook used for alerting.

Noise check0 of 1 fired

The baseline holds exactly one ordinary behaviour for this log type, and the rule does not fire on it. One event is close to no evidence: this says the rule is not caught by that one behaviour, and nothing more.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1567, T1567.002, T1567.003, T1567.004, evaluated against their dns_query events.

Share this rule

/u/siemphony/bb7e9b72-d184-4c7b-a32a-fb3816d1c7d0

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Non-browser process resolving a file-sharing or paste service

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it