Sigma rule: Possible DNS Rebinding

Rule

Title

Possible DNS Rebinding

Status

unsupported

Level

medium

Author

Ilyas Ochkov, oscd.community

Date

2019/10/25

Modified

2023/02/24

File

unsupported/windows/dns_query_win_possible_dns_rebinding.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects several different DNS-answers by one domain with IPs from internal and external networks. Normally, DNS-answer contain TTL >100. (DNS-record will saved in host cache for a while TTL).

Log source

product

windows

category

dns_query

Detection

dns_answer:
    QueryName: '*'
    QueryStatus: '0'
filter_int_ip:
    QueryResults|startswith:
        - '(::ffff:)?10.'
        - '(::ffff:)?192.168.'
        - '(::ffff:)?172.16.'
        - '(::ffff:)?172.17.'
        - '(::ffff:)?172.18.'
        - '(::ffff:)?172.19.'
        - '(::ffff:)?172.20.'
        - '(::ffff:)?172.21.'
        - '(::ffff:)?172.22.'
        - '(::ffff:)?172.23.'
        - '(::ffff:)?172.24.'
        - '(::ffff:)?172.25.'
        - '(::ffff:)?172.26.'
        - '(::ffff:)?172.27.'
        - '(::ffff:)?172.28.'
        - '(::ffff:)?172.29.'
        - '(::ffff:)?172.30.'
        - '(::ffff:)?172.31.'
        - '(::ffff:)?127.'
timeframe: 30s
condition: (dns_answer and filter_int_ip) and (dns_answer and not filter_int_ip) | count(QueryName) by ComputerName > 3

Tags

• attack.initial_access
• attack.t1189

MITRE ATT&CK ids this rule names

• T1189

References

• https://medium.com/@brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/unsupported/windows/dns_query_win_possible_dns_rebinding.yml