Date: 08/26/2024
Severity: Medium
Summary
Detects DNS queries for subdomains associated with the "Put.io" file-sharing website.
Indicators of Compromise (IOC) List
EventID | 3008 |
QueryName | 'api.put.io' 'upload.put.io' |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 | (resourceName = "Sysmon" AND eventtype = "3008" ) AND queryname In ( "api.put.io" , "upload.put.io" ) |
Detection Query 2 | (Technologygroup = "EDR" ) AND queryname In ( "api.put.io" , "upload.put.io" ) |
Reference:
Sigma Detection Rule for Windows DNS Client PUT.IO Activity
DarkAtlas Analysis of Medusa Ransomware Group OPSEC Failure