DNS Query to Wildcard DNS Services - Network

calendar Nov 5, 2026 · attack.command-and-control attack.t1071.004 attack.t1568  ·
Share on: linkedin copy

Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain. Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.

Sigma rule (View on GitHub)

 1title: DNS Query to Wildcard DNS Services - Network
 2id: 139ddcb3-ba90-4407-b0b1-1838131ce8e7
 3related:
 4    - id: 4f8a1c2e-7d3b-4e5f-9a6c-0b1d2e3f4a5b
 5      type: similar
 6status: experimental
 7description: |
 8    Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain.
 9    Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.    
10references:
11    - https://nip.io/
12    - https://sslip.io/
13    - https://traefik.me/
14    - https://github.polettix.it/ETOOBUSY/2022/10/09/nip-io-sslip-io/
15author: MahirAli Khan
16date: 2026-11-05
17tags:
18    - attack.command-and-control
19    - attack.t1071.004
20    - attack.t1568
21logsource:
22    category: dns
23detection:
24    selection:
25        query|endswith:
26            # IP-embedding services (subdomain encodes an arbitrary IP)
27            - '.1u.ms'
28            - '.backname.io'
29            - '.nip.io'
30            - '.sslip.io'
31            - '.traefik.me'
32            - '.xip.io'
33    condition: selection
34falsepositives:
35    - Developers using nip.io or sslip.io to test local HTTPS setups or Kubernetes ingress rules without modifying /etc/hosts
36    - CI/CD pipelines that provision ephemeral review environments with dynamically generated hostnames (e.g. PR-based preview deployments)
37level: medium

References

Related rules

to-top