huntrule

DNS Queries to OAST and Callback Domain Services

Detects DNS lookups to common OAST/callback domains that may indicate SSRF-style or blind vulnerability validation.

FreeReviewedSigma · High · v5
Category
dns
Author
Florian Roth (Nextron Systems), Matt Kelly (list of domains) (SigmaHQ), DRL 1.1
Published
2022-06-07
Updated
2026-10-14
AnalysisDetection

ATT&CK techniques

Recon → Initial Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags DNS lookups where the queried domain ends with known out-of-band application security testing (OAST) and callback service domains. Attackers and scanners use these services to confirm blind issues by forcing the target to resolve a controlled DNS name, which can indicate probing or exploitation attempts such as SSRF, XXE, blind RCE, or similar injection-driven callbacks. The detection relies on DNS query telemetry and matches specific domain suffixes indicating an interaction with these external testing/callback services.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Malicious WordPress Core SQL Injection Scanner via User-Agent
Suspicious SonicWall Access With Anomalous Chrome Linux User Agent via Webserver
Suspicious BeyondTrust Remote Support Probing of nw Endpoint via Webserver
Suspicious SonicWall SSL-VPN Reconnaissance Endpoints via Webserver
Suspicious Access to Spring Boot Actuator Heapdump Endpoint
Suspicious Cisco ASA WebVPN Login Scanning with Spoofed Chrome User-Agent
Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)
Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)
Malicious MS-SQL Server Spawning Command Shell via Mallox
DNS Queries to OAST and Callback Domain Services
Pivot detection · T1190 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-10-14
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.