DNS Query to Wildcard DNS Services - Windows

calendar Nov 5, 2026 · attack.command-and-control attack.t1071.004 attack.t1568  ·
Share on: linkedin copy

Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain. Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.

Sigma rule (View on GitHub)

 1title: DNS Query to Wildcard DNS Services - Windows
 2id: 4f8a1c2e-7d3b-4e5f-9a6c-0b1d2e3f4a5b
 3related:
 4    - id: 139ddcb3-ba90-4407-b0b1-1838131ce8e7
 5      type: similar
 6status: experimental
 7description: |
 8    Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain.
 9    Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.    
10references:
11    - https://nip.io/
12    - https://sslip.io/
13    - https://traefik.me/
14    - https://github.polettix.it/ETOOBUSY/2022/10/09/nip-io-sslip-io/
15author: MahirAli Khan, Swachchhanda Shrawan Poudel (Nextron Systems)
16date: 2026-11-05
17tags:
18    - attack.command-and-control
19    - attack.t1071.004
20    - attack.t1568
21logsource:
22    product: windows
23    category: dns_query
24detection:
25    selection:
26        QueryName|endswith:
27            # IP-embedding services (subdomain encodes an arbitrary IP)
28            - '.1u.ms'
29            - '.backname.io'
30            - '.nip.io'
31            - '.sslip.io'
32            - '.traefik.me'
33            - '.xip.io'
34    condition: selection
35falsepositives:
36    - Developers on Windows workstations testing local services or web applications without editing the hosts file
37level: medium
38regression_tests_path: regression_data/rules/windows/dns_query/dns_query_win_wildcard_dns_service/info.yml

References

Related rules

to-top