Windows Executable Connections to Dead Drop Resolver Domains Excluding Common Browsers

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1102Web Service
- T1102.001Dead Drop Resolver
Exfiltration
Impact

What it detects

This rule flags when a non-browser executable initiates network connections to a set of commonly used, legitimate web domains and subdomains that have been observed serving as dead drop resolvers. Such traffic can help attackers blend command-and-control or staging activity into normal web access patterns. It relies on Windows network connection events with destination hostname matching against the configured domain list and process image-based exclusions for common browsers and select legitimate clients.

Reporting behind it

Related detections9 linkedT1102 — drag to rearrange

Windows Network Connections to azurewebsites.net from Non-Browser Processes

Possible Telegram API Command and Control DNS Query

Malicious Anubis Ransomware Cloudflare Tunnel via cloudflared (via process_creation)

Possible DNS Queries to Public Ethereum RPC Endpoints for EtherHiding Payload Retrieval (via dns_query)

Possible ITG05 Headlace Staging via Mocky and Mockbin Services (via proxy)

PowerShell Remote Download From Bunny CDN Host

Suspicious DNS Query for TryCloudflare Tunnel Abused for Malware Delivery (via dns_query)

Possible Access-Code Validation Beacon to Malware Delivery C2 (via proxy)

Suspicious Payload Retrieval from Cloudflare Tunnel via LOLBin (via process_creation)

Windows Executable Connections to Dead Drop Resolver Domains Excluding Common Browsers

Pivot detection · T1102 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-network-connections-to-dead-drop-resolver-domains-from-non-browser-execu-297ae038

title: Windows Executable Connections to Dead Drop Resolver Domains Excluding Common Browsers
id: 87c4e355-2631-4997-ada3-a07eb0296c03
related:
  - id: d7b09985-95a3-44be-8450-b6eadf49833e
    type: obsolete
  - id: 8b48ad89-10d8-4382-a546-50588c410f0d
    type: similar
  - id: d635249d-86b5-4dad-a8c7-d7272b788586
    type: similar
  - id: 52182dfb-afb7-41db-b4bc-5336cb29b464
    type: similar
  - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
    type: similar
  - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
    type: similar
  - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
    type: similar
  - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c
    type: similar
  - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
    type: similar
  - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb
    type: similar
  - id: b6e04788-29e1-4557-bb14-77f761848ab8
    type: similar
  - id: a0d7e4d2-bede-4141-8896-bc6e237e977c
    type: similar
  - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
    type: derived
status: test
description: This rule flags when a non-browser executable initiates network connections to a set of commonly used, legitimate web domains and subdomains that have been observed serving as dead drop resolvers. Such traffic can help attackers blend command-and-control or staging activity into normal web access patterns. It relies on Windows network connection events with destination hostname matching against the configured domain list and process image-based exclusions for common browsers and select legitimate clients.
references:
  - https://web.archive.org/web/20220830134315/https://content.fireeye.com/apt-41/rpt-apt41/
  - https://securelist.com/the-tetrade-brazilian-banking-malware/97779/
  - https://blog.bushidotoken.net/2021/04/dead-drop-resolvers-espionage-inspired.html
  - https://github.com/kleiton0x00/RedditC2
  - https://twitter.com/kleiton0x7e/status/1600567316810551296
  - https://www.linkedin.com/posts/kleiton-kurti_github-kleiton0x00redditc2-abusing-reddit-activity-7009939662462984192-5DbI/?originalSubdomain=al
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_dead_drop_resolvers.yml
author: Sorina Ionescu, X__Junior (Nextron Systems), Huntrule Team
date: 2022-08-17
modified: 2026-03-29
tags:
  - attack.command-and-control
  - attack.t1102
  - attack.t1102.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith:
      - .t.me
      - 0x0.st
      - 4shared.com
      - abuse.ch
      - anonfiles.com
      - bashupload.com
      - cdn.discordapp.com
      - chunk.io
      - cloudflare.com
      - ddns.net
      - discord.com
      - docs.google.com
      - drive.google.com
      - dropbox.com
      - dropmefiles.com
      - facebook.com
      - feeds.rapidfeeds.com
      - fotolog.com
      - ghostbin.co/
      - githubusercontent.com
      - gofile.io
      - hastebin.com
      - imgur.com
      - livejournal.com
      - mediafire.com
      - mega.co.nz
      - mega.nz
      - onedrive.com
      - pages.dev
      - paste.ee
      - pastebin.com
      - pastebin.pl
      - pastetext.net
      - pixeldrain.com
      - privatlab.com
      - privatlab.net
      - reddit.com
      - send.exploit.in
      - sendspace.com
      - steamcommunity.com
      - storage.googleapis.com
      - technet.microsoft.com
      - temp.sh
      - transfer.sh
      - trycloudflare.com
      - twitter.com
      - ufile.io
      - vimeo.com
      - w3spaces.com
      - wetransfer.com
      - workers.dev
      - x0.at
      - youtube.com
  filter_main_chrome:
    Image:
      - C:\Program Files\Google\Chrome\Application\chrome.exe
      - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  filter_main_chrome_appdata:
    Image|startswith: C:\Users\
    Image|endswith: \AppData\Local\Google\Chrome\Application\chrome.exe
  filter_main_firefox:
    Image:
      - C:\Program Files\Mozilla Firefox\firefox.exe
      - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  filter_main_firefox_appdata:
    Image|startswith: C:\Users\
    Image|endswith: \AppData\Local\Mozilla Firefox\firefox.exe
  filter_main_ie:
    Image:
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      - C:\Program Files\Internet Explorer\iexplore.exe
  filter_main_edge_1:
    - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith: \WindowsApps\MicrosoftEdge.exe
    - Image:
        - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  filter_main_edge_2:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_main_safari:
    Image|contains:
      - C:\Program Files (x86)\Safari\
      - C:\Program Files\Safari\
    Image|endswith: \safari.exe
  filter_main_defender:
    Image|contains:
      - C:\Program Files\Windows Defender Advanced Threat Protection\
      - C:\Program Files\Windows Defender\
      - C:\ProgramData\Microsoft\Windows Defender\Platform\
    Image|endswith:
      - \MsMpEng.exe
      - \MsSense.exe
  filter_main_prtg:
    Image|endswith:
      - C:\Program Files (x86)\PRTG Network Monitor\PRTG Probe.exe
      - C:\Program Files\PRTG Network Monitor\PRTG Probe.exe
  filter_main_brave:
    Image|startswith: C:\Program Files\BraveSoftware\
    Image|endswith: \brave.exe
  filter_main_maxthon:
    Image|contains: \AppData\Local\Maxthon\
    Image|endswith: \maxthon.exe
  filter_main_opera:
    Image|contains: \AppData\Local\Programs\Opera\
    Image|endswith: \opera.exe
  filter_main_seamonkey:
    Image|startswith:
      - C:\Program Files\SeaMonkey\
      - C:\Program Files (x86)\SeaMonkey\
    Image|endswith: \seamonkey.exe
  filter_main_vivaldi:
    Image|contains: \AppData\Local\Vivaldi\
    Image|endswith: \vivaldi.exe
  filter_main_whale:
    Image|startswith:
      - C:\Program Files\Naver\Naver Whale\
      - C:\Program Files (x86)\Naver\Naver Whale\
    Image|endswith: \whale.exe
  filter_main_whaterfox:
    Image|startswith:
      - C:\Program Files\Waterfox\
      - C:\Program Files (x86)\Waterfox\
    Image|endswith: \Waterfox.exe
  filter_main_midori:
    Image|contains: \AppData\Local\Programs\midori-ng\
    Image|endswith: \Midori Next Generation.exe
  filter_main_slimbrowser:
    Image|startswith:
      - C:\Program Files\SlimBrowser\
      - C:\Program Files (x86)\SlimBrowser\
    Image|endswith: \slimbrowser.exe
  filter_main_flock:
    Image|contains: \AppData\Local\Flock\
    Image|endswith: \Flock.exe
  filter_main_phoebe:
    Image|contains: \AppData\Local\Phoebe\
    Image|endswith: \Phoebe.exe
  filter_main_falkon:
    Image|startswith:
      - C:\Program Files\Falkon\
      - C:\Program Files (x86)\Falkon\
    Image|endswith: \falkon.exe
  filter_main_qtweb:
    Image|startswith:
      - C:\Program Files (x86)\QtWeb\
      - C:\Program Files\QtWeb\
    Image|endswith: \QtWeb.exe
  filter_main_avant:
    Image|startswith:
      - C:\Program Files (x86)\Avant Browser\
      - C:\Program Files\Avant Browser\
    Image|endswith: \avant.exe
  filter_main_whatsapp:
    Image|startswith:
      - C:\Program Files (x86)\WindowsApps\
      - C:\Program Files\WindowsApps\
    Image|endswith: \WhatsApp.exe
    DestinationHostname|endswith: facebook.com
  filter_main_telegram:
    Image|contains: \AppData\Roaming\Telegram Desktop\
    Image|endswith: \Telegram.exe
    DestinationHostname|endswith: .t.me
  filter_main_onedrive:
    Image|contains: \AppData\Local\Microsoft\OneDrive\
    Image|endswith: \OneDrive.exe
    DestinationHostname|endswith: onedrive.com
  filter_main_dropbox:
    Image|startswith:
      - C:\Program Files (x86)\Dropbox\Client\
      - C:\Program Files\Dropbox\Client\
    Image|endswith:
      - \Dropbox.exe
      - \DropboxInstaller.exe
    DestinationHostname|endswith: dropbox.com
  filter_main_mega:
    Image|endswith:
      - \MEGAsync.exe
      - \MEGAsyncSetup32_*RC.exe
      - \MEGAsyncSetup32.exe
      - \MEGAsyncSetup64.exe
      - \MEGAupdater.exe
    DestinationHostname|endswith:
      - mega.co.nz
      - mega.nz
  filter_main_googledrive:
    Image|contains:
      - C:\Program Files\Google\Drive File Stream\
      - C:\Program Files (x86)\Google\Drive File Stream\
    Image|endswith: GoogleDriveFS.exe
    DestinationHostname|endswith: drive.google.com
  filter_main_discord:
    Image|contains: \AppData\Local\Discord\
    Image|endswith: \Discord.exe
    DestinationHostname|endswith:
      - discord.com
      - cdn.discordapp.com
  filter_main_null:
    Image: null
  filter_main_empty:
    Image: ""
  condition: selection and not 1 of filter_main_*
falsepositives:
  - One might need to exclude other internet browsers found in it's network or other applications like ones mentioned above from Microsoft Defender.
  - Ninite contacting githubusercontent.com
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL