DNS Query To Common Malware Hosting and Shortener Services

Ahmed Nosir (@egycondor)

Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners. These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc. Such DNS activity can indicate potential delivery or command-and-control communication attempts.

2025-06-02 00:00:00

None

f8c1e80b-c73a-476a-ae24-6c72528b1521

attack.command-and-control attack.t1071.004

Community Rule

egycondor

Merge PR #5453 from @egycondor - DNS Query To Common Malware Hosting and Shortener Services

2025-06-12