{"id":"f8c1e80b-c73a-476a-ae24-6c72528b1521","title":"DNS Query To Common Malware Hosting and Shortener Services","description":"Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners.\nThese include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc.\nSuch DNS activity can indicate potential delivery or command-and-control communication attempts.\n","author":"Ahmed Nosir (@egycondor)","status":"experimental","level":"medium","date":"2025-06-02","modified":"","tags":["attack.command-and-control","attack.t1071.004"],"technique_ids":["T1071.004"],"logsource":{"product":"windows","category":"dns_query"},"falsepositives":["Legitimate use of these services is possible but rare in enterprise environments"],"references":["https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics"],"source_path":"rules/windows/dns_query/dns_query_win_common_malware_hosting_services.yml","source_sha256":"da06f5d24bbb5be6cd11c9ecdcc7de064cc18b1131c1f6aad5384ac716d35c9f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/dns_query/dns_query_win_common_malware_hosting_services.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: DNS Query To Common Malware Hosting and Shortener Services\nid: f8c1e80b-c73a-476a-ae24-6c72528b1521\nstatus: experimental\ndescription: |\n    Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners.\n    These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc.\n    Such DNS activity can indicate potential delivery or command-and-control communication attempts.\nreferences:\n    - https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics\nauthor: Ahmed Nosir (@egycondor)\ndate: 2025-06-02\ntags:\n    - attack.command-and-control\n    - attack.t1071.004\nlogsource:\n    product: windows\n    category: dns_query\ndetection:\n    selection:\n        QueryName|contains:\n            - 'msapp.workers.dev'\n            - 'trycloudflare.com'\n            - 'infinityfreeapp.com'\n            - 'my5353.com'\n            - 'reurl.cc'\n            - 'lihi.cc'\n            - 'tinyurl.com'\n    condition: selection\nfalsepositives:\n    - Legitimate use of these services is possible but rare in enterprise environments\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1071.004","id":"T1071.004","name":"DNS","page":"techniques/enterprise/T1071.004/"}],"data_path":"data/detection-rules/f8c1e80b-c73a-476a-ae24-6c72528b1521.json","kind":"sigma"}