DNS Query to Wildcard DNS Services - Network

MahirAli Khan

Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain. Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.

2026-11-05 00:00:00

None

139ddcb3-ba90-4407-b0b1-1838131ce8e7

attack.command-and-control attack.t1071.004 attack.t1568

Community Rule

MahirAli Khan

Merge PR #5915 from @Mahir-Ali-khan - Add `DNS Query to Wildcard DNS Services`

2026-11-05