Windows DNS Queries to Known DPRK C2 Domains
Flags Windows DNS queries for specific DPRK-attributed C2 domain names.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- dns_query
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-02-20
- Updated
- 2026-07-31
What it detects
This rule flags DNS queries on Windows for specific domains associated with DPRK command-and-control infrastructure. Attackers rely on DNS lookups to resolve and maintain connectivity to remote systems, making these queries a practical telemetry source for early awareness. It matches the exact queried domain names observed in DNS query events.
Reporting behind it
- verfassungsschutz.dehttps://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2024-02-19-joint-cyber-security-advisory-englisch.pdf?__blob=publicationFile&v=2
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/DPRK/dns_query_win_apt_dprk_malicious_domains.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-dns-query-indicators-for-dprk-c2-domains-4d16c9a6
title: Windows DNS Queries to Known DPRK C2 Domains
id: 8145541f-5076-4b5b-ad27-89a976f055e3
status: test
description: This rule flags DNS queries on Windows for specific domains associated with DPRK command-and-control infrastructure. Attackers rely on DNS lookups to resolve and maintain connectivity to remote systems, making these queries a practical telemetry source for early awareness. It matches the exact queried domain names observed in DNS query events.
references:
- https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2024-02-19-joint-cyber-security-advisory-englisch.pdf?__blob=publicationFile&v=2
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/TA/DPRK/dns_query_win_apt_dprk_malicious_domains.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-20
tags:
- attack.command-and-control
- detection.emerging-threats
logsource:
product: windows
category: dns_query
detection:
selection:
QueryName:
- connection.lockscreen.kro.kr
- updating.dothome.co.kr
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 4d16c9a6-4362-4863-9940-1dee35f1d70f
type: derived