Skip to content

Hide Navigation Hide TOC

DNS Query To Ufile.io - DNS Client (090ffaad-c01a-4879-850c-6d57da98452d)

Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

Cluster A Galaxy A Cluster B Galaxy B Level
DNS Query To Ufile.io - DNS Client (090ffaad-c01a-4879-850c-6d57da98452d) Sigma-Rules Exfiltration to Cloud Storage - T1567.002 (bf1b6176-597c-4600-bfcd-ac989670f96b) Attack Pattern 1
Exfiltration Over Web Service - T1567 (40597f16-0963-4249-bf4c-ac93b7fb9807) Attack Pattern Exfiltration to Cloud Storage - T1567.002 (bf1b6176-597c-4600-bfcd-ac989670f96b) Attack Pattern 2