Add Rule: DNS Query To Put.io - DNS Client

[omaramin17]

Summary of the Pull Request

This PR adds rules related to detection of communications to put.io that was observed in Medusa Ransomware intrusions

Changelog

new: DNS Query To Put.io - DNS Client

Log Event

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
    <Provider Name='Microsoft-Windows-DNS-Client' Guid='{1c95126e-7eea-49a9-a3fe-a378b03ddb4d}'/>
    <EventID>3008</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime='2024-08-02T21:41:40.7280319Z'/>
    <EventRecordID>991659</EventRecordID>
    <Correlation/>
    <Execution ProcessID='6160' ThreadID='13288'/>
    <Channel>Microsoft-Windows-DNS-Client/Operational</Channel>
    <Computer>Redacted</Computer>
    <Security UserID='Redacted'/>
  </System>
  <EventData>
    <Data Name='QueryName'>upload.put.io</Data>
    <Data Name='QueryType'>1</Data>
    <Data Name='QueryOptions'>32784</Data>
    <Data Name='QueryStatus'>9701</Data>
    <Data Name='QueryResults'></Data>
  </EventData>
</Event>

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
    <Provider Name='Microsoft-Windows-DNS-Client' Guid='Redacted'/>
    <EventID>3008</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime='2024-08-02T21:41:40.7276716Z'/>
    <EventRecordID>991634</EventRecordID>
    <Correlation/>
    <Execution ProcessID='6160' ThreadID='13288'/>
    <Channel>Microsoft-Windows-DNS-Client/Operational</Channel>
    <Computer>Redacted</Computer>
    <Security UserID='S-1-5-18'/>
  </System>
  <EventData>
    <Data Name='QueryName'>api.put.io</Data>
    <Data Name='QueryType'>1</Data>
    <Data Name='QueryOptions'>32784</Data>
    <Data Name='QueryStatus'>9701</Data>
    <Data Name='QueryResults'></Data>
  </EventData>
</Event>

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @omaramin17 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃