DNS Query To Common Malware Hosting and Shortener Services — Sigma Rule

Rule metadata and linked tags

Author: Ahmed Nosir (@egycondor). Source status: experimental; severity: medium. Source dates: 2025-06-02 / not supplied.

{
  "product": "windows",
  "category": "dns_query"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: da06f5d24bbb5be6cd11c9ecdcc7de064cc18b1131c1f6aad5384ac716d35c9f

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: DNS Query To Common Malware Hosting and Shortener Services
id: f8c1e80b-c73a-476a-ae24-6c72528b1521
status: experimental
description: |
    Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners.
    These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc.
    Such DNS activity can indicate potential delivery or command-and-control communication attempts.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
author: Ahmed Nosir (@egycondor)
date: 2025-06-02
tags:
    - attack.command-and-control
    - attack.t1071.004
logsource:
    product: windows
    category: dns_query
detection:
    selection:
        QueryName|contains:
            - 'msapp.workers.dev'
            - 'trycloudflare.com'
            - 'infinityfreeapp.com'
            - 'my5353.com'
            - 'reurl.cc'
            - 'lihi.cc'
            - 'tinyurl.com'
    condition: selection
falsepositives:
    - Legitimate use of these services is possible but rare in enterprise environments
level: medium

Original YAML and metadata in JSON

False positives

• Legitimate use of these services is possible but rare in enterprise environments

Source references

• https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics