Sigma rule: DNS Query to External Service Interaction Domains

Rule

Title

DNS Query to External Service Interaction Domains

Status

test

Level

high

Author

Florian Roth (Nextron Systems), Matt Kelly (list of domains)

Date

2022-06-07

Modified

2026-10-13

File

rules/network/dns/net_dns_external_service_interaction_domains.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains.
These services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security
researchers and attackers alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and
Log4Shell-style injections, where the exploit payload triggers an external DNS lookup to a controlled domain.

A detection indicates that a host on your network resolved one of these domains, which may mean:
(1) an attacker is actively probing or exploiting a vulnerable service and using the callback to
confirm code execution or data exfiltration,
(2) a security scanner (e.g. Nuclei, Gobies) is running against internal targets.

Investigate the source host, the full DNS query string (the unique subdomain prefix encodes the callback session),
and any concurrent outbound connections or process activity to determine intent.

Log source

category

dns

Detection

selection:
    - query|endswith:
          - '.burpcollaborator.net' # Portswigger Burpsuite Collaborator
          - '.canarytokens.com' # Thinkst Canary Canarytokens
          - '.ceye.io'
          - '.ddns.1443.eu.org' # dig.pm
          - '.ddns.bypass.eu.org' # dig.pm
          - '.ddns.xn--gg8h.eu.org' # dig.pm
          - '.digimg.store' # dnslog.ink
          - '.dns.su18.org' # javaweb.org
          - '.dnshook.site' # webhook.site
          - '.dnslog.cn'
          - '.dnslog.ink' # dnslog.ink
          - '.gobygo.net' # gobies.org
          - '.instances.httpworkbench.com' # httpworkbench.com
          - '.interact.sh' # Project Discovery Interactsh
          - '.log.dnslog.pp.ua' # dnslog.org
          - '.log.dnslog.qzz.io' # dnslog.org
          - '.log.dnslogs.dpdns.org' # dnslog.org
          - '.log.javaweb.org' # javaweb.org
          - '.log.nat.cloudns.ph' # dnslog.org
          - '.oast.fun' # Project Discovery Interactsh
          - '.oast.live' # Project Discovery Interactsh
          - '.oast.me' # Project Discovery Interactsh
          - '.oast.online' # Project Discovery Interactsh
          - '.oast.pro' # Project Discovery Interactsh
          - '.oast.site' # Project Discovery Interactsh
          - '.oastify.com' # Portswigger Burpsuite Collaborator
          - '.p8.lol' # javaweb.org
          - '.requestbin.net'
          - '.requestrepo.com'
    - query: 'requestrepo.com'
filter_main_polling:
    query|contains: 'polling.oastify.com'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Legitimate security scanning.

Tags

• attack.initial-access
• attack.t1190
• attack.reconnaissance
• attack.t1595.002

MITRE ATT&CK ids this rule names

• T1190
• T1595.002

References

• https://twitter.com/breakersall/status/1533493587828260866
• https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287
• https://github.com/SigmaHQ/sigma/pull/5724#issuecomment-3466382234
• https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/network/dns/net_dns_external_service_interaction_domains.yml