Windows DNS Queries to Malware Hosting and URL Shortener Domains

Alert on Windows DNS queries to domains tied to URL shorteners and malware hosting services.

FreeUnreviewedSigmamediumv1

windows-dns-queries-to-malware-hosting-and-url-shortener-domains-f8c1e80b

title: Windows DNS Queries to Malware Hosting and URL Shortener Domains
id: c1fbee1e-3480-4f12-9379-e17a6ab65127
status: experimental
description: This rule flags Windows DNS queries whose queried names contain specific hostnames associated with common malware hosting platforms and URL shortening services. Attackers may rely on these domains to deliver payloads or redirect victims through shortened links, making DNS activity a useful signal for possible delivery or command-and-control patterns. It uses DNS query telemetry, matching the queried name against a fixed set of domain substrings.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_common_malware_hosting_services.yml
author: Ahmed Nosir (@egycondor), Huntrule Team
date: 2025-06-02
tags:
  - attack.command-and-control
  - attack.t1071.004
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|contains:
      - msapp.workers.dev
      - trycloudflare.com
      - infinityfreeapp.com
      - my5353.com
      - reurl.cc
      - lihi.cc
      - tinyurl.com
  condition: selection
falsepositives:
  - Legitimate use of these services is possible but rare in enterprise environments
level: medium
license: DRL-1.1
related:
  - id: f8c1e80b-c73a-476a-ae24-6c72528b1521
    type: derived

What it detects

This rule flags Windows DNS queries whose queried names contain specific hostnames associated with common malware hosting platforms and URL shortening services. Attackers may rely on these domains to deliver payloads or redirect victims through shortened links, making DNS activity a useful signal for possible delivery or command-and-control patterns. It uses DNS query telemetry, matching the queried name against a fixed set of domain substrings.

Known false positives

Legitimate use of these services is possible but rare in enterprise environments

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.