Code repository domain resolved by a script host or transfer tool

Siemphony@siemphonylowT1567.001unverified

Matches a DNS lookup for a public code-repository domain made by a scripting host, a transfer utility or Git's HTTPS helper, which is the outbound leg of AN0895 reduced to a single event. The dns_query source is chosen over the Sysmon EventID 3 connection event because the repository is identified by name and the connection event carries only an address — its DestinationHostname comes from a reverse lookup and resolves to nothing usable for these CDNs. `git.exe` is deliberately absent from the process list: `git push` over HTTPS hands the transport to `git-remote-https.exe`, so `git.exe` never issues the query and would be a dead selector here. The analytic's other two elements — the preceding read of a sensitive directory and MITRE's ExfilVolumeThreshold knob — need a correlation and a numeric comparison that Sigma cannot express, so this fires on the contact rather than on the volume moving through it, and it sees nothing at all unless the running Sysmon configuration enables DNS query logging. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0318, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cscript.exe" OR Image="*\\wscript.exe" OR Image="*\\mshta.exe" OR Image="*\\certutil.exe" OR Image="*\\curl.exe" OR Image="*\\python.exe" OR Image="*\\pythonw.exe" OR Image="*\\rclone.exe" OR Image="*\\git-remote-https.exe") AND (QueryName="*github.com" OR QueryName="*githubusercontent.com" OR QueryName="*gitlab.com" OR QueryName="*bitbucket.org" OR QueryName="*sourceforge.net"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\python.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pythonw.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rclone.exe" OR TO_LOWER(process.executable) LIKE "*\\\\git-remote-https.exe") AND (TO_LOWER(dns.question.name) LIKE "*github.com" OR TO_LOWER(dns.question.name) LIKE "*githubusercontent.com" OR TO_LOWER(dns.question.name) LIKE "*gitlab.com" OR TO_LOWER(dns.question.name) LIKE "*bitbucket.org" OR TO_LOWER(dns.question.name) LIKE "*sourceforge.net"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,dns_query,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\cscript\.exe$|\\wscript\.exe$|\\mshta\.exe$|\\certutil\.exe$|\\curl\.exe$|\\python\.exe$|\\pythonw\.exe$|\\rclone\.exe$|\\git-remote-https\.exe$)</field>    <field name="QueryName" type="pcre2">(?i)(github\.com$|githubusercontent\.com$|gitlab\.com$|bitbucket\.org$|sourceforge\.net$)</field>    <description>Code repository domain resolved by a script host or transfer tool</description>    <mitre>      <id>T1567.001</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"dns_query","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: dns_query / windows
Level: low
Category: data_staging_exfil
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 990761bd-7b63-4b65-b88c-575ea26b8272

ATT&CKT1567.001

T1567.001Exfiltration to Code Repository

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

AN0895 describes a scripting process making an outbound HTTPS POST to a code repository API, correlated with a preceding read of a sensitive directory and weighed against MITRE's ExfilVolumeThreshold knob. This rule implements neither the file-read precursor nor the volume threshold — it fires on a single DNS lookup for a repository domain issued by a listed process, which the description calls "the outbound leg of AN0895 reduced to a single event." A hit is contact with GitHub, GitLab, Bitbucket or SourceForge, not evidence anything was uploaded.

02 · Telemetry you need

category: dns_query, product: windows — Sysmon EventID 22. That component is not on in a stock Sysmon configuration; without it the rule sees nothing. translations.json shows Sentinel refuses outright ("No Sentinel table is modelled for this logsource"), so only Splunk, Elastic and Wazuh render. The rule reads DNS over the Sysmon EID 3 connection event deliberately: DestinationHostname on a connection record comes from a reverse lookup and typically resolves to nothing usable for these CDNs, while QueryName names the domain directly.

03 · How the logic works

Two selections, ANDed. selection_process matches Image|endswith against eleven binaries: powershell.exe, pwsh.exe, cscript.exe, wscript.exe, mshta.exe, certutil.exe, curl.exe, python.exe, pythonw.exe, rclone.exe, git-remote-https.exe. selection_repository matches QueryName|endswith against five domains: github.com, githubusercontent.com, gitlab.com, bitbucket.org, sourceforge.net. Those five populate MITRE's MonitoredDomains knob — the rule author's choice of which repositories to watch, not a list MITRE supplied. ExfilVolumeThreshold, the other knob, has no counterpart: Sigma has no numeric aggregation, so there is no way to weigh a lookup by bytes moved. git.exe is deliberately absent — git push over HTTPS hands the transport to git-remote-https.exe, so git.exe itself never issues the query and would be a dead selector.

04 · Common false positives

The review found a selector of exactly that dead kind still present: rclone.exe has no GitHub, GitLab, Bitbucket or SourceForge backend, and its self-update resolves downloads.rclone.org — it can never satisfy selection_repository and is a plausible-looking exfiltration binary that this domain gate can never catch it through. Second, in any estate with an explicit or PAC-configured proxy, powershell.exe, curl.exe and python.exe resolve the proxy's hostname, not the repository's, so Sysmon EID 22 for github.com is simply never generated — the review calls this the difference between quiet and blind, not documented anywhere in the description. Third, this rule and the T1102.002 C2 rule co-fire on the same DNS event — QueryName|endswith: 'github.com' here subsumes T1102.002's narrower api.github.com/gist.github.com terms, and the process lists overlap on nine of eleven names — yet the two rules disagree on severity (low here, medium there) for what is the identical observable. The rule's own false-positive entries cover developer workstations and CI, pip/ npm/poetry dependency fetches, scheduled updaters, and read/write-blind API automation; the review adds one they missed — Chocolatey, Scoop and winget resolving github.com on ordinary non-developer endpoints during routine installs.

05 · Detection maturity

tier_1: . Never executed; the rclone dead-selector and the proxy blind spot were both found by review reasoning, not by a log line.
tier_2: run read-only, first confirming DNS query logging is actually enabled and that the endpoint isn't proxied, then rank hits by `Image` to see which tool dominates.
tier_3: ** build the dropped correlation as a companion — sensitive-directory read (Security 4663 or Sysmon file_event) followed by a repository DNS lookup inside a time window — so the alert reflects AN0895's actual sequence instead of contact alone.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Drop rclone.exe from selection_process (it belongs with cloud-storage rules whose domains it actually resolves), or replace it with the endpoints rclone genuinely uses. State the proxy caveat in the description and pair this rule with proxy logs in any estate that forces HTTP(S) through one. Reconcile level with the T1102.002 rule so the same lookup does not carry two different severities in the corpus. If lookalike domains like notgithub.com matter, anchor the endswith terms with a leading dot.

Declared by the author

Developer workstations and build agents, which are most of what this rule matches: git-remote-https.exe resolves github.com on every clone, fetch and push, and a CI runner does it continuously. Wherever source control is part of the job this is the entire result set by a wide margin, which is why the level is set no higher than low.
Package and module installation. pip, poetry and npm driven through python.exe or a shell resolve github.com and codeload.github.com to fetch dependencies, and PowerShell bootstrap scripts pull install code from raw.githubusercontent.com — the same lookup an upload produces.
Updaters and security tooling that pull detection rules, signatures or release binaries from a repository's release hosting on a fixed schedule using curl.exe or a bundled python.exe.
Administrative and reporting automation querying the repository API for issue, release or membership metadata. A read and a write resolve the same name, so inventory scripts are indistinguishable from an exfiltration client at this event.

Noise check0 of 1 fired

The baseline holds exactly one ordinary behaviour for this log type, and the rule does not fire on it. One event is close to no evidence: this says the rule is not caught by that one behaviour, and nothing more.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1567.001, evaluated against their dns_query events.

Share this rule

/u/siemphony/990761bd-7b63-4b65-b88c-575ea26b8272

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Code repository domain resolved by a script host or transfer tool

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it