Network DNS Queries to IP-Embedding Wildcard DNS Services

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
- T1568Dynamic Resolution
Exfiltration
Impact

What it detects

This rule matches DNS queries whose names end with domains associated with IP-embedding wildcard DNS services. These services dynamically resolve subdomains that contain an encoded IP address, which can be abused to stand up infrastructure or communication endpoints without registering a custom domain. Detection relies on DNS query telemetry where the queried name suffix is available for pattern matching.

Reporting behind it

Related detections9 linkedT1071.004 — drag to rearrange

Windows DNS Queries to Public Wildcard IP-Encoding Domains

Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs

Suspicious OAST Callback DNS Query From Next.js Workload

Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)

Suspicious UPSTYLE Command Channel Pattern in Web Requests via CVE-2024-3400

Suspicious DNS C2 to Microsoft Typosquat Domain

Suspicious DNS Queries to Simitor Tracking Tunnel Infrastructure

Suspicious DNS Queries to Secshow Open Resolver Scanning Infrastructure

Suspicious OpenMetadata Exploit Interactsh OAST Callback (via process_creation)

Network DNS Queries to IP-Embedding Wildcard DNS Services

Pivot detection · T1071.004 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

network-dns-queries-to-ip-embedding-wildcard-dns-services-139ddcb3

title: Network DNS Queries to IP-Embedding Wildcard DNS Services
id: 086a1201-640f-46a9-8778-1eb8822291ed
related:
  - id: 4f8a1c2e-7d3b-4e5f-9a6c-0b1d2e3f4a5b
    type: similar
  - id: 139ddcb3-ba90-4407-b0b1-1838131ce8e7
    type: derived
status: experimental
description: This rule matches DNS queries whose names end with domains associated with IP-embedding wildcard DNS services. These services dynamically resolve subdomains that contain an encoded IP address, which can be abused to stand up infrastructure or communication endpoints without registering a custom domain. Detection relies on DNS query telemetry where the queried name suffix is available for pattern matching.
references:
  - https://nip.io/
  - https://sslip.io/
  - https://traefik.me/
  - https://github.polettix.it/ETOOBUSY/2022/10/09/nip-io-sslip-io/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_wildcard_dns_service.yml
author: MahirAli Khan, Huntrule Team
date: 2026-11-05
tags:
  - attack.command-and-control
  - attack.t1071.004
  - attack.t1568
logsource:
  category: dns
detection:
  selection:
    query|endswith:
      - .1u.ms
      - .backname.io
      - .nip.io
      - .sslip.io
      - .traefik.me
      - .xip.io
  condition: selection
falsepositives:
  - Developers using nip.io or sslip.io to test local HTTPS setups or Kubernetes ingress rules without modifying /etc/hosts
  - CI/CD pipelines that provision ephemeral review environments with dynamically generated hostnames (e.g. PR-based preview deployments)
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL