Detectionmediumexperimental
DNS Query to Wildcard DNS Services - Windows
Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain. Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.
MahirAli Khan, Swachchhanda Shrawan Poudel (Nextron Systems)Created 2026-11-054f8a1c2e-7d3b-4e5f-9a6c-0b1d2e3f4a5bwindows
Log Source
WindowsDNS Query
ProductWindows← raw: windows
CategoryDNS Query← raw: dns_query
DNS lookup events generated by endpoint monitoring tools.
Detection Logic
Detection Logic1 selector
detection:
selection:
QueryName|endswith:
# IP-embedding services (subdomain encodes an arbitrary IP)
- '.1u.ms'
- '.backname.io'
- '.nip.io'
- '.sslip.io'
- '.traefik.me'
- '.xip.io'
condition: selectionFalse Positives
Developers on Windows workstations testing local services or web applications without editing the hosts file
References
MITRE ATT&CK
Tactics
Techniques
Sub-techniques
Rule Metadata
Rule ID
4f8a1c2e-7d3b-4e5f-9a6c-0b1d2e3f4a5b
Status
experimental
Level
medium
Type
Detection
Created
2026-11-05
Path
rules/windows/dns_query/dns_query_win_wildcard_dns_service.yml
Raw Tags
attack.command-and-controlattack.t1071.004attack.t1568