DNS Query To Common Malware Hosting and Shortener Services
This rule detects DNS queries made to domains frequently used by threat actors for hosting malware payloads or for URL redirection via shortener services. The identified domains include those associated with platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc. Such DNS activity can be an indicator of potential malware delivery attempts or command-and-control (C2) communications.
Sigma
