DNS Queries to Low-Reputation eTLDs (AlphaSOC List)

title: DNS Queries to Low-Reputation eTLDs (AlphaSOC List)
id: e9bd31e5-e6c0-4668-a652-f966e2ef3423
status: experimental
description: This rule flags DNS queries whose names end with domains listed in a known low-reputation eTLD set. Attackers can use these namespaces to establish infrastructure and blend malicious communication into seemingly unremarkable DNS traffic. Detection relies on DNS query telemetry and matches only suffixes for the configured eTLDs sourced from the AlphaSOC bad-eTLD feed.
references:
  - https://feeds.alphasoc.net/bad-etlds.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/network/net_dns_low_reputation_etld.yml
author: Norbert Jaśniewicz (AlphaSOC), Huntrule Team
date: 2025-08-04
tags:
  - attack.command-and-control
  - attack.t1071.004
  - attack.initial-access
  - detection.threat-hunting
logsource:
  category: dns
detection:
  selection:
    query|endswith:
      - .duckdns.org
      - .top
      - .ddns.net
      - .gl.at.ply.gg
      - .portmap.io
      - .icu
      - .zapto.org
      - .live
      - .hopto.org
      - .portmap.host
      - .sbs
      - .sytes.net
      - .click
      - .ydns.eu
      - .site
      - .cloud
      - .no-ip.org
      - .kozow.com
      - .lat
      - .pro
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: cf5ee356-65c4-4556-8d11-6977fcdfed4b
    type: derived