Windows DNS Queries to Malware Hosting and URL Shortener Domains

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
Exfiltration
Impact

What it detects

This rule matches DNS query names containing specific domains associated with malware hosting platforms and URL shorteners. Attackers may use these services to deliver payloads or obscure final destinations through redirection. The detection relies on Windows DNS query telemetry, specifically the queried name field.

Reporting behind it

Related detections9 linkedT1071.004 — drag to rearrange

Suspicious Script Download via Curl and PowerShell by Dohdoor

DoT (DNS Over TLS) Activation - Command (via process_creation)

DoT (DNS Over TLS) Activation - PowerShell (via powershell)

Possible C2 Beacon with Fixed Authorization URI Parameter via proxy

Suspicious FinCounter DNS Tunneling Query via dns_query

Malicious SUNBURST Command and Control DNS Query to avsvmcloud Domain (via dns_query)

Suspicious Exploitation Callback to Dnslog Service (via dns_query)

Malicious Project CAV3RN DNS Configuration Recovery via cloudlanecdn.com (via dns_query)

Suspicious Entra Sign-In Interrupt With High Aggregated Risk via AiTM DNS Hijacking (via azure)

Windows DNS Queries to Malware Hosting and URL Shortener Domains

Pivot detection · T1071.004 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dns-queries-to-malware-hosting-and-url-shortener-domains-f8c1e80b

title: Windows DNS Queries to Malware Hosting and URL Shortener Domains
id: c1fbee1e-3480-4f12-9379-e17a6ab65127
status: experimental
description: This rule matches DNS query names containing specific domains associated with malware hosting platforms and URL shorteners. Attackers may use these services to deliver payloads or obscure final destinations through redirection. The detection relies on Windows DNS query telemetry, specifically the queried name field.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_common_malware_hosting_services.yml
author: Ahmed Nosir (@egycondor), Huntrule Team
date: 2025-06-02
tags:
  - attack.command-and-control
  - attack.t1071.004
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|contains:
      - msapp.workers.dev
      - trycloudflare.com
      - infinityfreeapp.com
      - my5353.com
      - reurl.cc
      - lihi.cc
      - tinyurl.com
  condition: selection
falsepositives:
  - Legitimate use of these services is possible but rare in enterprise environments
level: medium
license: DRL-1.1
related:
  - id: f8c1e80b-c73a-476a-ae24-6c72528b1521
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL