Detection rules › Sigma
DNS Query To Common Malware Hosting and Shortener Services
Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners. These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc. Such DNS activity can indicate potential delivery or command-and-control communication attempts.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control | T1071.004 Application Layer Protocol: DNS |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 22 | DNSEvent (DNS query) |
Rule body yaml
title: DNS Query To Common Malware Hosting and Shortener Services
id: f8c1e80b-c73a-476a-ae24-6c72528b1521
status: experimental
description: |
Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners.
These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc.
Such DNS activity can indicate potential delivery or command-and-control communication attempts.
references:
- https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
author: Ahmed Nosir (@egycondor)
date: 2025-06-02
tags:
- attack.command-and-control
- attack.t1071.004
logsource:
product: windows
category: dns_query
detection:
selection:
QueryName|contains:
- 'msapp.workers.dev'
- 'trycloudflare.com'
- 'infinityfreeapp.com'
- 'my5353.com'
- 'reurl.cc'
- 'lihi.cc'
- 'tinyurl.com'
condition: selection
falsepositives:
- Legitimate use of these services is possible but rare in enterprise environments
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
QueryName|contains:
- 'msapp.workers.dev'
- 'trycloudflare.com'
- 'infinityfreeapp.com'
- 'my5353.com'
- 'reurl.cc'
- 'lihi.cc'
- 'tinyurl.com'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
QueryName | match |
|