Windows Wscript-Initiated DNS Queries to Regex-Matched Domains (Potential C2)

Alerts when wscript.exe triggers DNS lookups for domains matching a C2-like regex pattern.

FreeUnreviewedSigmahighv1

windows-wscript-initiated-dns-queries-to-regex-matched-domains-potential-c2-70761fe8

title: Windows Wscript-Initiated DNS Queries to Regex-Matched Domains (Potential C2)
id: 84461ae5-2dff-452b-83d1-98c6fdcb430d
status: test
description: This rule flags DNS queries where the requesting process is wscript.exe and the queried domain name matches a specific regex pattern. Such behavior is notable because scripting hosts can be used to resolve attacker-controlled infrastructure during command-and-control. It relies on Windows DNS query telemetry that includes the process image path (or name) and the DNS QueryName.
references:
  - https://www.virustotal.com/gui/file/0e2854753d17b1bb534de8e765d5813c9fb584a745978b3d92bc6ca78e3e7735/relations
  - https://www.virustotal.com/gui/file/d5661009c461a8b20e1ad22f48609cc84dd90aee9182e026659dde4d46aaf25e/relations
  - https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/dns_query_win_malware_socgholish_second_stage_c2.yml
author: Dusty Miller, Huntrule Team
date: 2023-02-23
tags:
  - attack.command-and-control
  - attack.t1219.002
  - detection.emerging-threats
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    Image|endswith: \wscript.exe
    QueryName|re: "[a-f0-9]{4,8}\\.(?:[a-z0-9\\-]+\\.){2}[a-z0-9\\-]+"
  condition: selection
falsepositives:
  - Legitimate domain names matching the regex pattern by chance (e.g. domain controllers dc01.company.co.uk)
level: high
license: DRL-1.1
related:
  - id: 70761fe8-6aa2-4f80-98c1-a57049c08e66
    type: derived

What it detects

This rule flags DNS queries where the requesting process is wscript.exe and the queried domain name matches a specific regex pattern. Such behavior is notable because scripting hosts can be used to resolve attacker-controlled infrastructure during command-and-control. It relies on Windows DNS query telemetry that includes the process image path (or name) and the DNS QueryName.

Known false positives

Legitimate domain names matching the regex pattern by chance (e.g. domain controllers dc01.company.co.uk)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.