Windows DNS Query Indicators for DPRK C2 Domains

Flags Windows DNS queries for specific DPRK-attributed C2 domain names.

FreeUnreviewedSigmahighv1

windows-dns-query-indicators-for-dprk-c2-domains-4d16c9a6

title: Windows DNS Query Indicators for DPRK C2 Domains
id: 8145541f-5076-4b5b-ad27-89a976f055e3
status: test
description: This rule identifies Windows DNS query traffic where the queried domain matches specific C2-related domains attributed in the rule to DPRK threat activity. Attackers rely on DNS resolution to locate and communicate with command-and-control infrastructure while often blending into normal network lookups. The detection relies on DNS query telemetry capturing the full QueryName values for matching domains.
references:
  - https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2024-02-19-joint-cyber-security-advisory-englisch.pdf?__blob=publicationFile&v=2
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/DPRK/dns_query_win_apt_dprk_malicious_domains.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-20
tags:
  - attack.command-and-control
  - detection.emerging-threats
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName:
      - connection.lockscreen.kro.kr
      - updating.dothome.co.kr
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 4d16c9a6-4362-4863-9940-1dee35f1d70f
    type: derived

What it detects

This rule identifies Windows DNS query traffic where the queried domain matches specific C2-related domains attributed in the rule to DPRK threat activity. Attackers rely on DNS resolution to locate and communicate with command-and-control infrastructure while often blending into normal network lookups. The detection relies on DNS query telemetry capturing the full QueryName values for matching domains.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.