1200KM / sigma-rule
Network Connection Initiated To Mega.nz — Sigma Rule
Sigma rule fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4. Network Connection Initiated To Mega.nz — Sigma Rule. Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.
Rule metadata and linked tags
Author: Florian Roth (Nextron Systems). Source status: test; severity: low. Source dates: 2021-12-06 / 2024-05-31.
{
"category": "network_connection",
"product": "windows"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: 82c67957109ac524fc47a56d6f2164624ec8cdc29e9e267e1762727ffeda4da1
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Network Connection Initiated To Mega.nz
id: fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4
status: test
description: |
Detects a network connection initiated by a binary to "api.mega.co.nz".
Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.
references:
- https://megatools.megous.com/
- https://www.mandiant.com/resources/russian-targeting-gov-business
author: Florian Roth (Nextron Systems)
date: 2021-12-06
modified: 2024-05-31
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationHostname|endswith:
- 'mega.co.nz'
- 'mega.nz'
condition: selection
falsepositives:
- Legitimate MEGA installers and utilities are expected to communicate with this domain. Exclude hosts that are known to be allowed to use this tool.
level: low
False positives
- Legitimate MEGA installers and utilities are expected to communicate with this domain. Exclude hosts that are known to be allowed to use this tool.
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.