DNS Queries to OAST/Callback Service Domains (External DNS Interactions)

Detects DNS lookups to common OAST/callback domains that may indicate SSRF-style or blind vulnerability validation.

FreeUnreviewedSigmahighv1

dns-queries-to-oast-callback-service-domains-external-dns-interactions-aff715fa

title: DNS Queries to OAST/Callback Service Domains (External DNS Interactions)
id: c93f4ec1-2ea1-4659-8781-d02d6328a761
status: test
description: This rule flags DNS queries whose FQDN ends with known out-of-band application security testing (OAST) and callback service domains. Such interactions can indicate an attacker is probing or exploiting a system and using a controlled domain to verify blind behavior via DNS callbacks, or a legitimate scanner is enumerating internal targets. It relies on DNS telemetry capturing the full query name and applies a specific exclusion for polling.oastify.com queries to reduce noise.
references:
  - https://twitter.com/breakersall/status/1533493587828260866
  - https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287
  - https://github.com/SigmaHQ/sigma/pull/5724#issuecomment-3466382234
  - https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_external_service_interaction_domains.yml
author: Florian Roth (Nextron Systems), Matt Kelly (list of domains), Huntrule Team
date: 2022-06-07
modified: 2026-07-23
tags:
  - attack.initial-access
  - attack.t1190
  - attack.reconnaissance
  - attack.t1595.002
logsource:
  category: dns
detection:
  selection:
    query|endswith:
      - .burpcollaborator.net
      - .canarytokens.com
      - .ceye.io
      - .ddns.1443.eu.org
      - .ddns.bypass.eu.org
      - .ddns.xn--gg8h.eu.org
      - .digimg.store
      - .dns.su18.org
      - .dnshook.site
      - .dnslog.cn
      - .dnslog.ink
      - .gobygo.net
      - .instances.httpworkbench.com
      - .interact.sh
      - .log.dnslog.pp.ua
      - .log.dnslog.qzz.io
      - .log.dnslogs.dpdns.org
      - .log.javaweb.org
      - .log.nat.cloudns.ph
      - .oast.fun
      - .oast.live
      - .oast.me
      - .oast.online
      - .oast.pro
      - .oast.site
      - .oastify.com
      - .p8.lol
      - .requestbin.net
  filter_main_polling:
    query|contains: polling.oastify.com
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate security scanning.
level: high
license: DRL-1.1
related:
  - id: aff715fa-4dd5-497a-8db3-910bea555566
    type: derived

What it detects

This rule flags DNS queries whose FQDN ends with known out-of-band application security testing (OAST) and callback service domains. Such interactions can indicate an attacker is probing or exploiting a system and using a controlled domain to verify blind behavior via DNS callbacks, or a legitimate scanner is enumerating internal targets. It relies on DNS telemetry capturing the full query name and applies a specific exclusion for polling.oastify.com queries to reduce noise.

Known false positives

Legitimate security scanning.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.