Zeek DNS: Detect NKN Seed Domain Queries
Alerts on Zeek DNS queries containing "seed" and ending with .nkn.org, a pattern consistent with NKN network activity.
FreeReviewedSigma · Low · v2
- Product
- zeek
- Service
- dns
- Author
- Michael Portera (@mportatoes) (SigmaHQ), DRL 1.1
- Published
- 2022-04-21
- Updated
- 2026-07-31
What it detects
This rule identifies DNS queries that contain both the substring "seed" and the domain suffix ".nkn.org". Attackers may use NKN-related endpoints as part of a decentralized command-and-control workflow, so targeted domain lookups can be an early indicator of such activity. It relies on Zeek DNS telemetry, specifically the queried hostname content fields captured for DNS requests.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
zeek-dns-nkn-seed-domain-lookups-for-potential-c2-over-nkn-org-fa7703d6
title: "Zeek DNS: Detect NKN Seed Domain Queries"
id: c143d1ad-a2de-4b8c-a3b5-9d7ed707934b
status: test
description: This rule identifies DNS queries that contain both the substring "seed" and the domain suffix ".nkn.org". Attackers may use NKN-related endpoints as part of a decentralized command-and-control workflow, so targeted domain lookups can be an early indicator of such activity. It relies on Zeek DNS telemetry, specifically the queried hostname content fields captured for DNS requests.
references:
- https://github.com/nknorg/nkn-sdk-go
- https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/
- https://github.com/Maka8ka/NGLite
- https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dns_nkn.yml
author: Michael Portera (@mportatoes), Huntrule Team
date: 2022-04-21
tags:
- attack.command-and-control
logsource:
product: zeek
service: dns
detection:
selection:
query|contains|all:
- seed
- .nkn.org
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: fa7703d6-0ee8-4949-889c-48c84bc15b6f
type: derived