DNS Query to Wildcard DNS Services - Windows

MahirAli Khan, Swachchhanda Shrawan Poudel (Nextron Systems)

Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain. Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.

2026-11-05 00:00:00

None

4f8a1c2e-7d3b-4e5f-9a6c-0b1d2e3f4a5b

attack.command-and-control attack.t1071.004 attack.t1568

Community Rule

MahirAli Khan

Merge PR #5915 from @Mahir-Ali-khan - Add `DNS Query to Wildcard DNS Services`

2026-11-05