Download from Suspicious Dyndns Hosts

Original Source: [Sigma source]

Title: Download from Suspicious Dyndns Hosts
Status: test
Description:Detects download of certain file types from hosts with dynamic DNS names (selected list)
References:
-https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats
Author: Florian Roth (Nextron Systems)
Date: 2017-11-08
modified:2023-05-18
Tags:

-'attack.command-and-control'
-'attack.t1105'
-'attack.t1568'

Logsource:

category: proxy

Detection:
selection:
c-uri-extension:
-'exe'
-'vbs'
-'bat'
-'rar'
-'ps1'
-'doc'
-'docm'
-'xls'
-'xlsm'
-'pptm'
-'rtf'
-'hta'
-'dll'
-'ws'
-'wsf'
-'sct'
-'zip'

cs-host|endswith:
-'.hopto.org'
-'.no-ip.org'
-'.no-ip.info'
-'.no-ip.biz'
-'.no-ip.com'
-'.noip.com'
-'.ddns.name'
-'.myftp.org'
-'.myftp.biz'
-'.serveblog.net'
-'.servebeer.com'
-'.servemp3.com'
-'.serveftp.com'
-'.servequake.com'
-'.servehalflife.com'
-'.servehttp.com'
-'.servegame.com'
-'.servepics.com'
-'.myvnc.com'
-'.ignorelist.com'
-'.jkub.com'
-'.dlinkddns.com'
-'.jumpingcrab.com'
-'.ddns.info'
-'.mooo.com'
-'.dns-dns.com'
-'.strangled.net'
-'.adultdns.net'
-'.craftx.biz'
-'.ddns01.com'
-'.dns53.biz'
-'.dnsapi.info'
-'.dnsd.info'
-'.dnsdynamic.com'
-'.dnsdynamic.net'
-'.dnsget.org'
-'.fe100.net'
-'.flashserv.net'
-'.ftp21.net'
-'.http01.com'
-'.http80.info'
-'.https443.com'
-'.imap01.com'
-'.kadm5.com'
-'.mysq1.net'
-'.ns360.info'
-'.ntdll.net'
-'.ole32.com'
-'.proxy8080.com'
-'.sql01.com'
-'.ssh01.com'
-'.ssh22.net'
-'.tempors.com'
-'.tftpd.net'
-'.ttl60.com'
-'.ttl60.org'
-'.user32.com'
-'.voip01.com'
-'.wow64.net'
-'.x64.me'
-'.xns01.com'
-'.dyndns.org'
-'.dyndns.info'
-'.dyndns.tv'
-'.dyndns-at-home.com'
-'.dnsomatic.com'
-'.zapto.org'
-'.webhop.net'
-'.25u.com'
-'.slyip.net'

condition:selection
Falsepositives:
-Software downloads
Level: medium