Malicious DNS Query To Common Malware Hosting and Shortener Services (via dns_query)

title: Malicious DNS Query To Common Malware Hosting and Shortener Services (via dns_query)
id: 6b805f0b-a022-5171-9430-73f5745597f3
status: stable
description: This rule detects DNS queries to domains frequently used by threat actors to host malware payloads or redirect through URL shorteners. These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc. Such DNS behavior can indicate potential delivery or command-and-control communication attempts.
references:
    - https://attack.mitre.org/techniques/T1071/004/
    - https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
author: Huntrule Team
date: 2026-03-01
tags:
    - attack.command-and-control
    - attack.t1071.004
logsource:
    product: windows
    category: dns_query
detection:
    selection:
        QueryName|contains:
            - 'msapp.workers.dev'
            - 'trycloudflare.com'
            - 'infinityfreeapp.com'
            - 'my5353.com'
            - 'reurl.cc'
            - 'lihi.cc'
            - 'tinyurl.com'
    condition: selection
falsepositives:
    - Unknown
level: medium