Download from Suspicious Dyndns Hosts — Sigma Rule

Rule metadata and linked tags

Author: Florian Roth (Nextron Systems). Source status: test; severity: medium. Source dates: 2017-11-08 / 2023-05-18.

{
  "category": "proxy"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 0f3d060cb46310b5ea27a79d2dc68b4a5ec3adbb4adfcb3c6677a16e4b30271b

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Download from Suspicious Dyndns Hosts
id: 195c1119-ef07-4909-bb12-e66f5e07bf3c
status: test
description: Detects download of certain file types from hosts with dynamic DNS names (selected list)
references:
    - https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats
author: Florian Roth (Nextron Systems)
date: 2017-11-08
modified: 2023-05-18
tags:
    - attack.command-and-control
    - attack.t1105
    - attack.t1568
logsource:
    category: proxy
detection:
    selection:
        c-uri-extension:
            - 'exe'
            - 'vbs'
            - 'bat'
            - 'rar'
            - 'ps1'
            - 'doc'
            - 'docm'
            - 'xls'
            - 'xlsm'
            - 'pptm'
            - 'rtf'
            - 'hta'
            - 'dll'
            - 'ws'
            - 'wsf'
            - 'sct'
            - 'zip'
            # If you want to add more extensions - see https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/
        cs-host|endswith:
            - '.hopto.org'
            - '.no-ip.org'
            - '.no-ip.info'
            - '.no-ip.biz'
            - '.no-ip.com'
            - '.noip.com'
            - '.ddns.name'
            - '.myftp.org'
            - '.myftp.biz'
            - '.serveblog.net'
            - '.servebeer.com'
            - '.servemp3.com'
            - '.serveftp.com'
            - '.servequake.com'
            - '.servehalflife.com'
            - '.servehttp.com'
            - '.servegame.com'
            - '.servepics.com'
            - '.myvnc.com'
            - '.ignorelist.com'
            - '.jkub.com'
            - '.dlinkddns.com'
            - '.jumpingcrab.com'
            - '.ddns.info'
            - '.mooo.com'
            - '.dns-dns.com'
            - '.strangled.net'
            - '.adultdns.net'
            - '.craftx.biz'
            - '.ddns01.com'
            - '.dns53.biz'
            - '.dnsapi.info'
            - '.dnsd.info'
            - '.dnsdynamic.com'
            - '.dnsdynamic.net'
            - '.dnsget.org'
            - '.fe100.net'
            - '.flashserv.net'
            - '.ftp21.net'
            - '.http01.com'
            - '.http80.info'
            - '.https443.com'
            - '.imap01.com'
            - '.kadm5.com'
            - '.mysq1.net'
            - '.ns360.info'
            - '.ntdll.net'
            - '.ole32.com'
            - '.proxy8080.com'
            - '.sql01.com'
            - '.ssh01.com'
            - '.ssh22.net'
            - '.tempors.com'
            - '.tftpd.net'
            - '.ttl60.com'
            - '.ttl60.org'
            - '.user32.com'
            - '.voip01.com'
            - '.wow64.net'
            - '.x64.me'
            - '.xns01.com'
            - '.dyndns.org'
            - '.dyndns.info'
            - '.dyndns.tv'
            - '.dyndns-at-home.com'
            - '.dnsomatic.com'
            - '.zapto.org'
            - '.webhop.net'
            - '.25u.com'
            - '.slyip.net'
    condition: selection
falsepositives:
    - Software downloads
level: medium

Original YAML and metadata in JSON

False positives

• Software downloads

Source references

• https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats