Network Connection Initiated To Mega.nz

Status: test
Severity: low
Log source: category network_connection, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.

Known false positives

Legitimate MEGA installers and utilities are expected to communicate with this domain. Exclude hosts that are known to be allowed to use this tool.

MITRE ATT&CK coverage

Tactic	Techniques
Exfiltration	`T1567.002` Exfiltration Over Web Service: Exfiltration to Cloud Storage

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 3: Network connection

Rule body

title: Network Connection Initiated To Mega.nz
id: fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4
status: test
description: |
    Detects a network connection initiated by a binary to "api.mega.co.nz".
    Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.
references:
    - https://megatools.megous.com/
    - https://www.mandiant.com/resources/russian-targeting-gov-business
author: Florian Roth (Nextron Systems)
date: 2021-12-06
modified: 2024-05-31
tags:
    - attack.exfiltration
    - attack.t1567.002
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|endswith:
            - 'mega.co.nz'
            - 'mega.nz'
    condition: selection
falsepositives:
    - Legitimate MEGA installers and utilities are expected to communicate with this domain. Exclude hosts that are known to be allowed to use this tool.
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Initiated: 'true'
    DestinationHostname|endswith:
        - 'mega.co.nz'
        - 'mega.nz'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DestinationHostname`	ends_with	`mega.co.nz` corpus 3 (sigma 3) `mega.nz` corpus 3 (sigma 3)	`field:"DestinationHostname" kind:ends_with`
`Initiated`	eq	`true` corpus 50 (sigma 50)	`field:"Initiated" kind:eq value:"true"`