Proxy Downloads of Executable and Script Files from Suspicious Dynamic DNS Hosts

title: Proxy Downloads of Executable and Script Files from Suspicious Dynamic DNS Hosts
id: 1fafab40-b624-469a-bce2-644e84df51c8
status: test
description: This rule flags proxy HTTP requests where the requested URI ends with high-risk file extensions (e.g., exe, vbs, ps1, bat, hta, dll, doc/docm, xls/xlsm, rtf, zip) and the destination host ends with selected dynamic DNS domains. Attackers often use dynamic DNS services to host and serve payloads or lure targets to download malicious files while keeping infrastructure flexible. Telemetry required includes proxy logs capturing the full request URI (including extension) and the host (FQDN) being accessed.
references:
  - https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_download_susp_dyndns.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-11-08
modified: 2023-05-18
tags:
  - attack.command-and-control
  - attack.t1105
  - attack.t1568
logsource:
  category: proxy
detection:
  selection:
    c-uri-extension:
      - exe
      - vbs
      - bat
      - rar
      - ps1
      - doc
      - docm
      - xls
      - xlsm
      - pptm
      - rtf
      - hta
      - dll
      - ws
      - wsf
      - sct
      - zip
    cs-host|endswith:
      - .hopto.org
      - .no-ip.org
      - .no-ip.info
      - .no-ip.biz
      - .no-ip.com
      - .noip.com
      - .ddns.name
      - .myftp.org
      - .myftp.biz
      - .serveblog.net
      - .servebeer.com
      - .servemp3.com
      - .serveftp.com
      - .servequake.com
      - .servehalflife.com
      - .servehttp.com
      - .servegame.com
      - .servepics.com
      - .myvnc.com
      - .ignorelist.com
      - .jkub.com
      - .dlinkddns.com
      - .jumpingcrab.com
      - .ddns.info
      - .mooo.com
      - .dns-dns.com
      - .strangled.net
      - .adultdns.net
      - .craftx.biz
      - .ddns01.com
      - .dns53.biz
      - .dnsapi.info
      - .dnsd.info
      - .dnsdynamic.com
      - .dnsdynamic.net
      - .dnsget.org
      - .fe100.net
      - .flashserv.net
      - .ftp21.net
      - .http01.com
      - .http80.info
      - .https443.com
      - .imap01.com
      - .kadm5.com
      - .mysq1.net
      - .ns360.info
      - .ntdll.net
      - .ole32.com
      - .proxy8080.com
      - .sql01.com
      - .ssh01.com
      - .ssh22.net
      - .tempors.com
      - .tftpd.net
      - .ttl60.com
      - .ttl60.org
      - .user32.com
      - .voip01.com
      - .wow64.net
      - .x64.me
      - .xns01.com
      - .dyndns.org
      - .dyndns.info
      - .dyndns.tv
      - .dyndns-at-home.com
      - .dnsomatic.com
      - .zapto.org
      - .webhop.net
      - .25u.com
      - .slyip.net
  condition: selection
falsepositives:
  - Software downloads
level: medium
license: DRL-1.1
related:
  - id: 195c1119-ef07-4909-bb12-e66f5e07bf3c
    type: derived