DNS Queries to OAST and Callback Domain Services

Detects DNS lookups to common OAST/callback domains that may indicate SSRF-style or blind vulnerability validation.

FreeReviewedSigma · High · v5

Category: dns
Author: Florian Roth (Nextron Systems), Matt Kelly (list of domains) (SigmaHQ), DRL 1.1
Published: 2022-06-07
Updated: 2026-10-14

ATT&CK techniques

Recon → Initial Access

Recon
- T1595.002Vulnerability Scanning
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags DNS lookups where the queried domain ends with known out-of-band application security testing (OAST) and callback service domains. Attackers and scanners use these services to confirm blind issues by forcing the target to resolve a controlled DNS name, which can indicate probing or exploitation attempts such as SSRF, XXE, blind RCE, or similar injection-driven callbacks. The detection relies on DNS query telemetry and matches specific domain suffixes indicating an interaction with these external testing/callback services.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious WordPress Core SQL Injection Scanner via User-Agent

Suspicious SonicWall Access With Anomalous Chrome Linux User Agent via Webserver

Suspicious BeyondTrust Remote Support Probing of nw Endpoint via Webserver

Suspicious SonicWall SSL-VPN Reconnaissance Endpoints via Webserver

Suspicious Access to Spring Boot Actuator Heapdump Endpoint

Suspicious Cisco ASA WebVPN Login Scanning with Spoofed Chrome User-Agent

Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)

Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)

Malicious MS-SQL Server Spawning Command Shell via Mallox

DNS Queries to OAST and Callback Domain Services

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-10-14
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

dns-queries-to-oast-callback-service-domains-external-dns-interactions-aff715fa

title: DNS Queries to OAST and Callback Domain Services
id: c93f4ec1-2ea1-4659-8781-d02d6328a761
status: test
description: This rule flags DNS lookups where the queried domain ends with known out-of-band application security testing (OAST) and callback service domains. Attackers and scanners use these services to confirm blind issues by forcing the target to resolve a controlled DNS name, which can indicate probing or exploitation attempts such as SSRF, XXE, blind RCE, or similar injection-driven callbacks. The detection relies on DNS query telemetry and matches specific domain suffixes indicating an interaction with these external testing/callback services.
references:
  - https://twitter.com/breakersall/status/1533493587828260866
  - https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287
  - https://github.com/SigmaHQ/sigma/pull/5724#issuecomment-3466382234
  - https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_external_service_interaction_domains.yml
author: Florian Roth (Nextron Systems), Matt Kelly (list of domains), Huntrule Team
date: 2022-06-07
modified: 2026-10-13
tags:
  - attack.initial-access
  - attack.t1190
  - attack.reconnaissance
  - attack.t1595.002
logsource:
  category: dns
detection:
  selection:
    - query|endswith:
        - .burpcollaborator.net
        - .canarytokens.com
        - .ceye.io
        - .ddns.1443.eu.org
        - .ddns.bypass.eu.org
        - .ddns.xn--gg8h.eu.org
        - .digimg.store
        - .dns.su18.org
        - .dnshook.site
        - .dnslog.cn
        - .dnslog.ink
        - .gobygo.net
        - .instances.httpworkbench.com
        - .interact.sh
        - .log.dnslog.pp.ua
        - .log.dnslog.qzz.io
        - .log.dnslogs.dpdns.org
        - .log.javaweb.org
        - .log.nat.cloudns.ph
        - .oast.fun
        - .oast.live
        - .oast.me
        - .oast.online
        - .oast.pro
        - .oast.site
        - .oastify.com
        - .p8.lol
        - .requestbin.net
        - .requestrepo.com
    - query: requestrepo.com
  filter_main_polling:
    query|contains: polling.oastify.com
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate security scanning.
level: high
license: DRL-1.1
related:
  - id: aff715fa-4dd5-497a-8db3-910bea555566
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL