huntrule

Windows DNS Queries to Public Wildcard IP-Encoding Domains

Alerts on Windows DNS queries ending with wildcard IP-encoding services like nip.io and sslip.io that can be used for C2 or phishing staging.

FreeReviewedSigma · Medium · v1
Product
windows
Category
dns_query
Author
MahirAli Khan, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2026-11-05
Updated
2026-11-05
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches Windows DNS queries whose query name ends with specific wildcard domains that encode an IP address in the subdomain. Attackers can use these public services to resolve arbitrary hostnames to chosen IPs, enabling infrastructure and potential C2 or phishing staging without registering a dedicated domain. It relies on Windows DNS query telemetry, specifically the QueryName suffix in DNS resolution events.

Reporting behind it

Related detections9 linkedT1071.004 — drag to rearrange
Network DNS Queries to IP-Embedding Wildcard DNS Services
Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs
Suspicious OAST Callback DNS Query From Next.js Workload
Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)
Suspicious UPSTYLE Command Channel Pattern in Web Requests via CVE-2024-3400
Suspicious DNS C2 to Microsoft Typosquat Domain
Suspicious DNS Queries to Simitor Tracking Tunnel Infrastructure
Suspicious DNS Queries to Secshow Open Resolver Scanning Infrastructure
Suspicious OpenMetadata Exploit Interactsh OAST Callback (via process_creation)
Windows DNS Queries to Public Wildcard IP-Encoding Domains
Pivot detection · T1071.004 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.