DNS Query to Wildcard DNS Services - Windows

SigmaHQ Detections@sigmaHQ

•updated yesterday•0•0•0

Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain. Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.