Suspicious DNS Query from Mounted Virtual Disk

[rule]
description = """
Identifies DNS queries to commonly abused legit web services by a process running from a mounted virtual disk (.iso,
.vhd).
"""
id = "3bc98de7-3349-43ac-869c-58357ae2aac0"
license = "Elastic License v2"
name = "Suspicious DNS Query from Mounted Virtual Disk"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/globally-distributed-stealers"]
version = "1.0.36"

query = '''
sequence by process.entity_id with maxspan=5m
 [process where event.action == "start" and
  (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*") and
  not process.hash.sha256 : "cf4179ffdb3eda997a26340edaa70a85f919093d0753239eb4a38d7dc3a1107d"]
 [dns where
  dns.question.name :
       (
        /* common ddns */
        "*.no-ip.com",
        "*.no-ip.org",
        "*.no-ip.biz",
        "*.no-ip.info",
        "*.noip.com",
        "*.afraid.org",
        "*.changeip.com",
        "*.ddns.net",
        "*.dyndns.org",
        "*.hopto.org",
        "*.zapto.org",
        "*.servehttp.com",
        "*.sytes.net",
        "*.myftp.biz",
        "*.myftp.org",
        "*.ddnsfree.com",
        "*.duckdns.org",
        "*.000webhostapp.com",
        "*.myddns.me",
        "*.dlinkddns.com",
        "*.chickenkiller.com",
        "*.thddns.net",
        "*.linkpc.net",
        "*.gotdns.ch",
        "*.ydns.eu",
        "*.dynv6.net",
        "*.dns.army",
        "*.dns.navy",
        "*.v6.army",
        "*.v6.navy",
        "*.v6.rocks",


        /* common websvc */
        "raw.githubusercontent.*",
        "github.com",
        "pastebin.*",
        "paste4btc.com",
        "paste.ee",
        "ghostbin.com",
        "drive.google.com",
        "?.docs.live.net",
        "api.dropboxapi.*",
        "content.dropboxapi.*",
        "dl.dropboxusercontent.*",
        "api.onedrive.com",
        "*.onedrive.org",
        "onedrive.live.com",
        "filebin.net",
        "*.ngrok.io",
        "ngrok.com",
        "*.ngrok-free.app",
        "*.portmap.*",
        "*serveo.net",
        "*localtunnel.me",
        "*pagekite.me",
        "*localxpose.io",
        "*notabug.org",
        "rawcdn.githack.*",
        "paste.nrecom.net",
        "zerobin.net",
        "controlc.com",
        "requestbin.net",
        "api.slack.com",
        "slack-redir.net",
        "slack-files.com",
        "cdn.discordapp.com",
        "discordapp.com",
        "discord.com",
        "apis.azureedge.net",
        "cdn.sql.gg",
        "?.top4top.io",
        "top4top.io",
        "www.uplooder.net",
        "*.cdnmegafiles.com",
        "transfer.sh",
        "gofile.io",
        "store?.gofile.io",
        "updates.peer2profit.com",
        "api.telegram.org",
        "t.me",
        "meacz.gq",
        "rwrd.org",
        "*.publicvm.com",
        "*.blogspot.com",
        "api.mylnikov.org",
        "file.io",
        "stackoverflow.com",
        "*files.1drv.com",
        "api.anonfile.com",
        "*hosting-profi.de",
        "ipbase.com",
        "ipfs.io",
        "*up.freeo*.space",
        "mail.*",
        "smtp.*",
        "api.mylnikov.org",
        "script.google.com",
        "script.googleusercontent.com",
        "api.notion.com",
        "graph.microsoft.com",
        "*.sharepoint.com",
        "mbasic.facebook.com",
        "login.live.com",
        "api.gofile.io",
        "api.anonfiles.com",
        "api.notion.com",
        "api.trello.com",
        "gist.githubusercontent.com",
        "files.pythonhosted.org",
        "g.live.com",
        "*.zulipchat.com",

        /* public IP discovery */
        "ip-api.com",
        "checkip.dyndns.org",
        "api.ipify.org",
        "whatismyip.akamai.com",
        "bot.whatismyipaddress.com",
        "ifcfg.me",
        "ident.me",
        "ipof.in",
        "ip.tyk.nu",
        "icanhazip.com",
        "curlmyip.com",
        "wgetip.com",
        "eth0.me",
        "ipecho.net",
        "ip.appspot.com",
        "api.myip.com",
        "geoiptool.com",
        "api.2ip.ua",
        "api.ip.sb",
        "ipinfo.io",
        "checkip.amazonaws.com",
        "wtfismyip.com",
        "iplogger.*",
        "freegeoip.net",
        "freegeoip.app",
        "ipinfo.io",
        "geoplugin.net",
        "myip.dnsomatic.com",
        "www.geoplugin.net",
        "api64.ipify.org",
        "ip4.seeip.org",
        "*.geojs.io",
        "*portmap.io",
        "*mediafire.com",
        "filetransfer.io",
        "api.gofile.io",
        "api.anonfiles.com",
        "api.trello.com",
        "api.2ip.ua",
        "api.db-ip.com",
        "geolocation-db.com",
        "httpbin.org",
        "www.myexternalip.com",
        "ipwho.is",

        /* other */
        "*.lencr.org",
        "*.cloudfront.net",
        "*azureedge.net",
        "*azure.com",
        "graph.microsoft.com",
        "cld.pt",
        "yandex.ru",
        "*.yandex.ru",
        "*.aternos.me",
        "geo.netsupportsoftware.com",
        "webhook.site")]
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"



[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.4.0"