DNS Queries to Low-Reputation Effective TLDs (eTLD) via Known Bad TLD List

Alerts on DNS queries targeting domains under known low-reputation eTLD suffixes from an external threat-intel list.

FreeReviewedSigma · Medium · v5

Category: dns
Author: Norbert Jaśniewicz (AlphaSOC) (SigmaHQ), DRL 1.1
Published: 2025-08-04
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
Exfiltration
Impact

What it detects

This rule flags DNS queries whose domain names end with specific low-reputation effective top-level domains (eTLDs). Attackers may use these domains to blend in with less-trusted infrastructure during command-and-control or initial access. The detection relies on DNS query telemetry containing the queried domain name and matches it against a predefined list of high-risk suffixes sourced from AlphaSOC threat intelligence, updated monthly.

Reporting behind it

Related detections9 linkedT1071.004 — drag to rearrange

Suspicious Script Download via Curl and PowerShell by Dohdoor

DoT (DNS Over TLS) Activation - Command (via process_creation)

DoT (DNS Over TLS) Activation - PowerShell (via powershell)

Possible C2 Beacon with Fixed Authorization URI Parameter via proxy

Suspicious FinCounter DNS Tunneling Query via dns_query

Malicious SUNBURST Command and Control DNS Query to avsvmcloud Domain (via dns_query)

Suspicious Exploitation Callback to Dnslog Service (via dns_query)

Malicious Project CAV3RN DNS Configuration Recovery via cloudlanecdn.com (via dns_query)

Suspicious Entra Sign-In Interrupt With High Aggregated Risk via AiTM DNS Hijacking (via azure)

DNS Queries to Low-Reputation Effective TLDs (eTLD) via Known Bad TLD List

Pivot detection · T1071.004 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

dns-queries-to-low-reputation-etlds-alphasoc-list-cf5ee356

title: DNS Queries to Low-Reputation Effective TLDs (eTLD) via Known Bad TLD List
id: e9bd31e5-e6c0-4668-a652-f966e2ef3423
status: experimental
description: This rule flags DNS queries whose domain names end with specific low-reputation effective top-level domains (eTLDs). Attackers may use these domains to blend in with less-trusted infrastructure during command-and-control or initial access. The detection relies on DNS query telemetry containing the queried domain name and matches it against a predefined list of high-risk suffixes sourced from AlphaSOC threat intelligence, updated monthly.
references:
  - https://feeds.alphasoc.net/bad-etlds.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/network/net_dns_low_reputation_etld.yml
author: Norbert Jaśniewicz (AlphaSOC), Huntrule Team
date: 2025-08-04
tags:
  - attack.command-and-control
  - attack.t1071.004
  - attack.initial-access
  - detection.threat-hunting
logsource:
  category: dns
detection:
  selection:
    query|endswith:
      - .duckdns.org
      - .top
      - .ddns.net
      - .gl.at.ply.gg
      - .portmap.io
      - .icu
      - .zapto.org
      - .live
      - .hopto.org
      - .portmap.host
      - .sbs
      - .sytes.net
      - .click
      - .ydns.eu
      - .site
      - .cloud
      - .no-ip.org
      - .kozow.com
      - .lat
      - .pro
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: cf5ee356-65c4-4556-8d11-6977fcdfed4b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL