Low Reputation Effective Top-Level Domain (eTLD) DNS Query

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•0•24

Detects DNS queries to domains within known low reputation Effective Top-Level Domains (eTLDs). These eTLDs are often associated with malicious activities such as command and control, phishing, or malware distribution. The rule leverages a curated list of suspicious eTLDs, which is updated periodically.