{"id":"195c1119-ef07-4909-bb12-e66f5e07bf3c","title":"Download from Suspicious Dyndns Hosts","description":"Detects download of certain file types from hosts with dynamic DNS names (selected list)","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2017-11-08","modified":"2023-05-18","tags":["attack.command-and-control","attack.t1105","attack.t1568"],"technique_ids":["T1105","T1568"],"logsource":{"category":"proxy"},"falsepositives":["Software downloads"],"references":["https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats"],"source_path":"rules/web/proxy_generic/proxy_download_susp_dyndns.yml","source_sha256":"0f3d060cb46310b5ea27a79d2dc68b4a5ec3adbb4adfcb3c6677a16e4b30271b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_download_susp_dyndns.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Download from Suspicious Dyndns Hosts\nid: 195c1119-ef07-4909-bb12-e66f5e07bf3c\nstatus: test\ndescription: Detects download of certain file types from hosts with dynamic DNS names (selected list)\nreferences:\n    - https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats\nauthor: Florian Roth (Nextron Systems)\ndate: 2017-11-08\nmodified: 2023-05-18\ntags:\n    - attack.command-and-control\n    - attack.t1105\n    - attack.t1568\nlogsource:\n    category: proxy\ndetection:\n    selection:\n        c-uri-extension:\n            - 'exe'\n            - 'vbs'\n            - 'bat'\n            - 'rar'\n            - 'ps1'\n            - 'doc'\n            - 'docm'\n            - 'xls'\n            - 'xlsm'\n            - 'pptm'\n            - 'rtf'\n            - 'hta'\n            - 'dll'\n            - 'ws'\n            - 'wsf'\n            - 'sct'\n            - 'zip'\n            # If you want to add more extensions - see https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/\n        cs-host|endswith:\n            - '.hopto.org'\n            - '.no-ip.org'\n            - '.no-ip.info'\n            - '.no-ip.biz'\n            - '.no-ip.com'\n            - '.noip.com'\n            - '.ddns.name'\n            - '.myftp.org'\n            - '.myftp.biz'\n            - '.serveblog.net'\n            - '.servebeer.com'\n            - '.servemp3.com'\n            - '.serveftp.com'\n            - '.servequake.com'\n            - '.servehalflife.com'\n            - '.servehttp.com'\n            - '.servegame.com'\n            - '.servepics.com'\n            - '.myvnc.com'\n            - '.ignorelist.com'\n            - '.jkub.com'\n            - '.dlinkddns.com'\n            - '.jumpingcrab.com'\n            - '.ddns.info'\n            - '.mooo.com'\n            - '.dns-dns.com'\n            - '.strangled.net'\n            - '.adultdns.net'\n            - '.craftx.biz'\n            - '.ddns01.com'\n            - '.dns53.biz'\n            - '.dnsapi.info'\n            - '.dnsd.info'\n            - '.dnsdynamic.com'\n            - '.dnsdynamic.net'\n            - '.dnsget.org'\n            - '.fe100.net'\n            - '.flashserv.net'\n            - '.ftp21.net'\n            - '.http01.com'\n            - '.http80.info'\n            - '.https443.com'\n            - '.imap01.com'\n            - '.kadm5.com'\n            - '.mysq1.net'\n            - '.ns360.info'\n            - '.ntdll.net'\n            - '.ole32.com'\n            - '.proxy8080.com'\n            - '.sql01.com'\n            - '.ssh01.com'\n            - '.ssh22.net'\n            - '.tempors.com'\n            - '.tftpd.net'\n            - '.ttl60.com'\n            - '.ttl60.org'\n            - '.user32.com'\n            - '.voip01.com'\n            - '.wow64.net'\n            - '.x64.me'\n            - '.xns01.com'\n            - '.dyndns.org'\n            - '.dyndns.info'\n            - '.dyndns.tv'\n            - '.dyndns-at-home.com'\n            - '.dnsomatic.com'\n            - '.zapto.org'\n            - '.webhop.net'\n            - '.25u.com'\n            - '.slyip.net'\n    condition: selection\nfalsepositives:\n    - Software downloads\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1568","id":"T1568","name":"Dynamic Resolution","page":"techniques/enterprise/T1568/"}],"data_path":"data/detection-rules/195c1119-ef07-4909-bb12-e66f5e07bf3c.json","kind":"sigma"}