DNS lookups for commonly abused TLDs
Some top level domains (TLDs) are more commonly associated with malware for a range of reasons - including how easy domains on these TLDs are to obtain. Many of these may be undesirable from an enterprise policy…
Description
Some top level domains (TLDs) are more commonly associated with malware for a range of reasons - including how easy domains on these TLDs are to obtain. Many of these may be undesirable from an enterprise policy perspective. You can update and extend the list of TLD's you wish to search for. The NameCount column provides an initial insight into how widespread the domain usage is across the environment.
Detection logic
Detection requirements
- Platform
- ESXiIaaSLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows
The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.
- Log source product
- dns
- Log source service
- dnsevents
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
No references are available for this detection.
From the source
- At source
- Open at source
- Upstream identifier
- 8e9c4680-8c0b-4885-b183-3b09efd8fc2c
- Tagged by the source as
- CommandAndControlExfiltration
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Published
- Sep 1, 2026
- Version
- 1