Detection rules › Splunk

Process Connection to Mega - Windows (Windows Event Log)

Group by
_time, host
Source
github.com/anvilogic-forge/armory

Mega is a cloud storage service used by many threat actors due to its use of end-to-end encryption and semi-anonymous payment options. The client application MEGAsync.exe and command-line interface utility MegaCMD allow threat actors to exfiltrate large amounts of data. This use case detects network connections involving MEGASync.exe or MegaCMD or network connections to mega.co.nz or mega.nz (Sysmon only).

MITRE ATT&CK coverage

TacticTechniques
ExfiltrationT1567 Exfiltration Over Web Service

References

Event coverage

Rule body yaml

id: '35864.62857'
title: Process Connection to Mega - Windows
description: Mega is a cloud storage service used by many threat actors due to its
  use of end-to-end encryption and semi-anonymous payment options. The client application
  MEGAsync.exe and command-line interface utility MegaCMD allow threat actors to exfiltrate
  large amounts of data. This use case detects network connections involving MEGASync.exe
  or MegaCMD or network connections to mega.co.nz or mega.nz (Sysmon only).
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5156) OR
  "<EventID>5156<") "Megasync.exe" OR "megacmd" | where match(process_name, "(?i)mega(sync|cmd)")
  | table _time, host, user, process, process_*, parent_process_*, dest_host | bin
  span=300s | stats values(*) as * by _time, host '
techniques:
- exfiltration:exfiltration over web service
technique_id: 
- T1567
data_category:
- Windows event logs
- Process use of network
references:
- https://redcanary.com/blog/threat-detection/rclone-mega-extortion/

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5156) OR "<EventID>5156<") "Megasync.exe" OR "megacmd"

Stage 2: where

| where match(process_name, "(?i)mega(sync|cmd)")

Stage 3: table

| table _time, host, user, process, process_*, parent_process_*, dest_host

Stage 4: bucket

| bin span=300s

Stage 5: stats

| stats values(*) as * by _time, host

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 5156 corpus 15 (splunk 13, kusto 2)
process_namematch
  • "(?i)mega(sync|cmd)" corpus 2 (splunk 2)

Search terms

Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.

StageTerm
1TERM
1"<EventID>5156<"
1"Megasync.exe"
1"megacmd"