Windows DNS queries containing Diamond Sleet–related domains
Alerts on Windows DNS queries for QueryName values containing specific Diamond Sleet–related domains.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- dns_query
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-10-24
- Updated
- 2026-07-31
What it detects
This rule matches DNS queries on Windows where the query name contains any of four hard-coded domains tied to Diamond Sleet indicators. Attackers may use domain infrastructure for command-and-control or staging, so these specific lookups can provide early detection signals. The detection relies on DNS query telemetry that includes the queried name (QueryName) and evaluates substring matches.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Diamond-Sleet/dns_query_win_apt_diamond_steel_indicators.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-dns-query-detection-for-diamond-sleet-related-domains-fba38e0f
title: Windows DNS queries containing Diamond Sleet–related domains
id: bcb8a25a-fb2b-43ad-81d0-696cdd354560
status: test
description: This rule matches DNS queries on Windows where the query name contains any of four hard-coded domains tied to Diamond Sleet indicators. Attackers may use domain infrastructure for command-and-control or staging, so these specific lookups can provide early detection signals. The detection relies on DNS query telemetry that includes the queried name (QueryName) and evaluates substring matches.
references:
- https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Diamond-Sleet/dns_query_win_apt_diamond_steel_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-24
tags:
- attack.command-and-control
- detection.emerging-threats
logsource:
product: windows
category: dns_query
detection:
selection:
QueryName|contains:
- 3dkit.org
- dersmarketim.com
- galerielamy.com
- olidhealth.com
condition: selection
falsepositives:
- Might generate some false positive if triggered by a user during investigation for example.
level: high
license: DRL-1.1
related:
- id: fba38e0f-4607-4344-bb8f-a4b50cdeef7f
type: derived