Windows Network Connections to Dead-Drop Resolver Domains from Non-Browser Executables

Flags non-browser Windows executables making outbound connections to known dead-drop resolver domain patterns.

FreeUnreviewedSigmahighv1

windows-network-connections-to-dead-drop-resolver-domains-from-non-browser-execu-297ae038

title: Windows Network Connections to Dead-Drop Resolver Domains from Non-Browser Executables
id: 87c4e355-2631-4997-ada3-a07eb0296c03
related:
  - id: d7b09985-95a3-44be-8450-b6eadf49833e
    type: obsolete
  - id: 8b48ad89-10d8-4382-a546-50588c410f0d
    type: similar
  - id: d635249d-86b5-4dad-a8c7-d7272b788586
    type: similar
  - id: 52182dfb-afb7-41db-b4bc-5336cb29b464
    type: similar
  - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
    type: similar
  - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
    type: similar
  - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
    type: similar
  - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c
    type: similar
  - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
    type: similar
  - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb
    type: similar
  - id: b6e04788-29e1-4557-bb14-77f761848ab8
    type: similar
  - id: a0d7e4d2-bede-4141-8896-bc6e237e977c
    type: similar
  - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
    type: derived
status: test
description: This rule identifies Windows processes that initiate outbound network connections and reach destination hostnames ending in a set of popular, previously observed dead-drop resolver domains. It matters because malware and related payloads can use legitimate web destinations as covert rendezvous points to receive or stage commands while blending in with normal traffic. The detection relies on network connection events with an Initiated=true indicator and process image path telemetry to exclude known internet browsers and other common applications.
references:
  - https://web.archive.org/web/20220830134315/https://content.fireeye.com/apt-41/rpt-apt41/
  - https://securelist.com/the-tetrade-brazilian-banking-malware/97779/
  - https://blog.bushidotoken.net/2021/04/dead-drop-resolvers-espionage-inspired.html
  - https://github.com/kleiton0x00/RedditC2
  - https://twitter.com/kleiton0x7e/status/1600567316810551296
  - https://www.linkedin.com/posts/kleiton-kurti_github-kleiton0x00redditc2-abusing-reddit-activity-7009939662462984192-5DbI/?originalSubdomain=al
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_dead_drop_resolvers.yml
author: Sorina Ionescu, X__Junior (Nextron Systems), Huntrule Team
date: 2022-08-17
modified: 2026-03-29
tags:
  - attack.command-and-control
  - attack.t1102
  - attack.t1102.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith:
      - .t.me
      - 0x0.st
      - 4shared.com
      - abuse.ch
      - anonfiles.com
      - bashupload.com
      - cdn.discordapp.com
      - chunk.io
      - cloudflare.com
      - ddns.net
      - discord.com
      - docs.google.com
      - drive.google.com
      - dropbox.com
      - dropmefiles.com
      - facebook.com
      - feeds.rapidfeeds.com
      - fotolog.com
      - ghostbin.co/
      - githubusercontent.com
      - gofile.io
      - hastebin.com
      - imgur.com
      - livejournal.com
      - mediafire.com
      - mega.co.nz
      - mega.nz
      - onedrive.com
      - pages.dev
      - paste.ee
      - pastebin.com
      - pastebin.pl
      - pastetext.net
      - pixeldrain.com
      - privatlab.com
      - privatlab.net
      - reddit.com
      - send.exploit.in
      - sendspace.com
      - steamcommunity.com
      - storage.googleapis.com
      - technet.microsoft.com
      - temp.sh
      - transfer.sh
      - trycloudflare.com
      - twitter.com
      - ufile.io
      - vimeo.com
      - w3spaces.com
      - wetransfer.com
      - workers.dev
      - x0.at
      - youtube.com
  filter_main_chrome:
    Image:
      - C:\Program Files\Google\Chrome\Application\chrome.exe
      - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  filter_main_chrome_appdata:
    Image|startswith: C:\Users\
    Image|endswith: \AppData\Local\Google\Chrome\Application\chrome.exe
  filter_main_firefox:
    Image:
      - C:\Program Files\Mozilla Firefox\firefox.exe
      - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  filter_main_firefox_appdata:
    Image|startswith: C:\Users\
    Image|endswith: \AppData\Local\Mozilla Firefox\firefox.exe
  filter_main_ie:
    Image:
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      - C:\Program Files\Internet Explorer\iexplore.exe
  filter_main_edge_1:
    - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith: \WindowsApps\MicrosoftEdge.exe
    - Image:
        - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  filter_main_edge_2:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_main_safari:
    Image|contains:
      - C:\Program Files (x86)\Safari\
      - C:\Program Files\Safari\
    Image|endswith: \safari.exe
  filter_main_defender:
    Image|contains:
      - C:\Program Files\Windows Defender Advanced Threat Protection\
      - C:\Program Files\Windows Defender\
      - C:\ProgramData\Microsoft\Windows Defender\Platform\
    Image|endswith:
      - \MsMpEng.exe
      - \MsSense.exe
  filter_main_prtg:
    Image|endswith:
      - C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe
      - C:\Program Files\PRTG Network Monitor\PRTG Probe.exe
  filter_main_brave:
    Image|startswith: C:\Program Files\BraveSoftware\
    Image|endswith: \brave.exe
  filter_main_maxthon:
    Image|contains: \AppData\Local\Maxthon\
    Image|endswith: \maxthon.exe
  filter_main_opera:
    Image|contains: \AppData\Local\Programs\Opera\
    Image|endswith: \opera.exe
  filter_main_seamonkey:
    Image|startswith:
      - C:\Program Files\SeaMonkey\
      - C:\Program Files (x86)\SeaMonkey\
    Image|endswith: \seamonkey.exe
  filter_main_vivaldi:
    Image|contains: \AppData\Local\Vivaldi\
    Image|endswith: \vivaldi.exe
  filter_main_whale:
    Image|startswith:
      - C:\Program Files\Naver\Naver Whale\
      - C:\Program Files (x86)\Naver\Naver Whale\
    Image|endswith: \whale.exe
  filter_main_whaterfox:
    Image|startswith:
      - C:\Program Files\Waterfox\
      - C:\Program Files (x86)\Waterfox\
    Image|endswith: \Waterfox.exe
  filter_main_midori:
    Image|contains: \AppData\Local\Programs\midori-ng\
    Image|endswith: \Midori Next Generation.exe
  filter_main_slimbrowser:
    Image|startswith:
      - C:\Program Files\SlimBrowser\
      - C:\Program Files (x86)\SlimBrowser\
    Image|endswith: \slimbrowser.exe
  filter_main_flock:
    Image|contains: \AppData\Local\Flock\
    Image|endswith: \Flock.exe
  filter_main_phoebe:
    Image|contains: \AppData\Local\Phoebe\
    Image|endswith: \Phoebe.exe
  filter_main_falkon:
    Image|startswith:
      - C:\Program Files\Falkon\
      - C:\Program Files (x86)\Falkon\
    Image|endswith: \falkon.exe
  filter_main_qtweb:
    Image|startswith:
      - C:\Program Files (x86)\QtWeb\
      - C:\Program Files\QtWeb\
    Image|endswith: \QtWeb.exe
  filter_main_avant:
    Image|startswith:
      - C:\Program Files (x86)\Avant Browser\
      - C:\Program Files\Avant Browser\
    Image|endswith: \avant.exe
  filter_main_whatsapp:
    Image|startswith:
      - C:\Program Files (x86)\WindowsApps\
      - C:\Program Files\WindowsApps\
    Image|endswith: \WhatsApp.exe
    DestinationHostname|endswith: facebook.com
  filter_main_telegram:
    Image|contains: \AppData\Roaming\Telegram Desktop\
    Image|endswith: \Telegram.exe
    DestinationHostname|endswith: .t.me
  filter_main_onedrive:
    Image|contains: \AppData\Local\Microsoft\OneDrive\
    Image|endswith: \OneDrive.exe
    DestinationHostname|endswith: onedrive.com
  filter_main_dropbox:
    Image|startswith:
      - C:\Program Files (x86)\Dropbox\Client\
      - C:\Program Files\Dropbox\Client\
    Image|endswith:
      - \Dropbox.exe
      - \DropboxInstaller.exe
    DestinationHostname|endswith: dropbox.com
  filter_main_mega:
    Image|endswith:
      - \MEGAsync.exe
      - \MEGAsyncSetup32_*RC.exe
      - \MEGAsyncSetup32.exe
      - \MEGAsyncSetup64.exe
      - \MEGAupdater.exe
    DestinationHostname|endswith:
      - mega.co.nz
      - mega.nz
  filter_main_googledrive:
    Image|contains:
      - C:\Program Files\Google\Drive File Stream\
      - C:\Program Files (x86)\Google\Drive File Stream\
    Image|endswith: GoogleDriveFS.exe
    DestinationHostname|endswith: drive.google.com
  filter_main_discord:
    Image|contains: \AppData\Local\Discord\
    Image|endswith: \Discord.exe
    DestinationHostname|endswith:
      - discord.com
      - cdn.discordapp.com
  filter_main_null:
    Image: null
  filter_main_empty:
    Image: ""
  condition: selection and not 1 of filter_main_*
falsepositives:
  - One might need to exclude other internet browsers found in it's network or other applications like ones mentioned above from Microsoft Defender.
  - Ninite contacting githubusercontent.com
level: high
license: DRL-1.1

What it detects

This rule identifies Windows processes that initiate outbound network connections and reach destination hostnames ending in a set of popular, previously observed dead-drop resolver domains. It matters because malware and related payloads can use legitimate web destinations as covert rendezvous points to receive or stage commands while blending in with normal traffic. The detection relies on network connection events with an Initiated=true indicator and process image path telemetry to exclude known internet browsers and other common applications.

Known false positives

One might need to exclude other internet browsers found in it's network or other applications like ones mentioned above from Microsoft Defender.
Ninite contacting githubusercontent.com

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.