Detect Suspicious DNS Queries to Axios Supply-Chain C2 Domains

Alerts on DNS queries to known malicious C2 domains tied to an Axios npm supply-chain compromise.

FreeUnreviewedSigmahighv1

detect-suspicious-dns-queries-to-axios-supply-chain-c2-domains-73e5d24f

title: Detect Suspicious DNS Queries to Axios Supply-Chain C2 Domains
id: 7ba3fcaf-1dad-4ab7-9705-32ae9e21f8dd
status: experimental
description: This rule flags DNS queries attempting to resolve specific attacker-controlled domains associated with an Axios npm supply-chain compromise. Such lookups matter because they indicate systems may be contacting malicious infrastructure for command-and-control communication. It relies on DNS telemetry capturing queried domain names that exactly match the listed C2 domains.
references:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
  - https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/net_dns_axios_npm_compromise_indicator.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-01
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1568
  - detection.emerging-threats
logsource:
  category: dns
detection:
  selection:
    query:
      - sfrclak.com
      - calltan.com
      - callnrwise.com
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 73e5d24f-493f-4092-bd2f-c72cabda40ee
    type: derived

What it detects

This rule flags DNS queries attempting to resolve specific attacker-controlled domains associated with an Axios npm supply-chain compromise. Such lookups matter because they indicate systems may be contacting malicious infrastructure for command-and-control communication. It relies on DNS telemetry capturing queried domain names that exactly match the listed C2 domains.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.