Dynamic DNS Provider Lookup - Possible C2 Infrastructure

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•27

This rule detects DNS queries to known dynamic DNS providers, which can be indicative of Command and Control (C2) infrastructure. Adversaries often use dynamic DNS services to maintain persistent access to compromised systems, as the IP addresses of their C2 servers may change frequently. The rule specifically looks for queries containing domains like duckdns.org, no-ip.com, ddns.net, hopto.org, zapto.org, and sytes.net.