Proxy Downloads of Executables and Documents from Suspicious Dynamic DNS Domains

title: Proxy Downloads of Executables and Documents from Suspicious Dynamic DNS Domains
id: 1fafab40-b624-469a-bce2-644e84df51c8
status: test
description: This rule flags proxy requests where the requested URI ends with commonly used file types (executables, scripts, and document formats) and the destination host ends with a selected set of dynamic DNS domain suffixes. Attackers may use dynamic DNS to host or stage payloads while avoiding stable infrastructure indicators. Detection relies on proxy telemetry that includes the request URI extension and the contacted host name.
references:
  - https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_download_susp_dyndns.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-11-08
modified: 2023-05-18
tags:
  - attack.command-and-control
  - attack.t1105
  - attack.t1568
logsource:
  category: proxy
detection:
  selection:
    c-uri-extension:
      - exe
      - vbs
      - bat
      - rar
      - ps1
      - doc
      - docm
      - xls
      - xlsm
      - pptm
      - rtf
      - hta
      - dll
      - ws
      - wsf
      - sct
      - zip
    cs-host|endswith:
      - .hopto.org
      - .no-ip.org
      - .no-ip.info
      - .no-ip.biz
      - .no-ip.com
      - .noip.com
      - .ddns.name
      - .myftp.org
      - .myftp.biz
      - .serveblog.net
      - .servebeer.com
      - .servemp3.com
      - .serveftp.com
      - .servequake.com
      - .servehalflife.com
      - .servehttp.com
      - .servegame.com
      - .servepics.com
      - .myvnc.com
      - .ignorelist.com
      - .jkub.com
      - .dlinkddns.com
      - .jumpingcrab.com
      - .ddns.info
      - .mooo.com
      - .dns-dns.com
      - .strangled.net
      - .adultdns.net
      - .craftx.biz
      - .ddns01.com
      - .dns53.biz
      - .dnsapi.info
      - .dnsd.info
      - .dnsdynamic.com
      - .dnsdynamic.net
      - .dnsget.org
      - .fe100.net
      - .flashserv.net
      - .ftp21.net
      - .http01.com
      - .http80.info
      - .https443.com
      - .imap01.com
      - .kadm5.com
      - .mysq1.net
      - .ns360.info
      - .ntdll.net
      - .ole32.com
      - .proxy8080.com
      - .sql01.com
      - .ssh01.com
      - .ssh22.net
      - .tempors.com
      - .tftpd.net
      - .ttl60.com
      - .ttl60.org
      - .user32.com
      - .voip01.com
      - .wow64.net
      - .x64.me
      - .xns01.com
      - .dyndns.org
      - .dyndns.info
      - .dyndns.tv
      - .dyndns-at-home.com
      - .dnsomatic.com
      - .zapto.org
      - .webhop.net
      - .25u.com
      - .slyip.net
  condition: selection
falsepositives:
  - Software downloads
level: medium
license: DRL-1.1
related:
  - id: 195c1119-ef07-4909-bb12-e66f5e07bf3c
    type: derived