huntrule

Network DNS Queries to IP-Embedding Wildcard DNS Services

Flags DNS queries to wildcard services that embed an IP in the subdomain (e.g., nip.io, sslip.io).

FreeReviewedSigma · Medium · v1
Category
dns
Author
MahirAli Khan (SigmaHQ), DRL 1.1
Published
2026-11-05
Updated
2026-11-05
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches DNS queries whose names end with domains associated with IP-embedding wildcard DNS services. These services dynamically resolve subdomains that contain an encoded IP address, which can be abused to stand up infrastructure or communication endpoints without registering a custom domain. Detection relies on DNS query telemetry where the queried name suffix is available for pattern matching.

Reporting behind it

Related detections9 linkedT1071.004 — drag to rearrange
Windows DNS Queries to Public Wildcard IP-Encoding Domains
Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs
Suspicious OAST Callback DNS Query From Next.js Workload
Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)
Suspicious UPSTYLE Command Channel Pattern in Web Requests via CVE-2024-3400
Suspicious DNS C2 to Microsoft Typosquat Domain
Suspicious DNS Queries to Simitor Tracking Tunnel Infrastructure
Suspicious DNS Queries to Secshow Open Resolver Scanning Infrastructure
Suspicious OpenMetadata Exploit Interactsh OAST Callback (via process_creation)
Network DNS Queries to IP-Embedding Wildcard DNS Services
Pivot detection · T1071.004 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.