Query: alert when Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains. These services (
Matching passage: Sigma rule: Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains. These services (. Logsource: dns. Rule: title: DNS Query to External Service Interaction Domains id: aff715fa-4dd5-497a-8db3-910bea555566 status: test description: "Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains.\nThese\ \ services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security\nresearchers and attackers\ \ alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and\nLog4Shell-style injections, where the exploit\ \ payload triggers an external DNS lookup to a controlled domain.\n\nA detection indicates that a host on your network resolved\ \ one of these domains, which may mean:\n (1) an attacker is actively probing or exploiting a vulnerable service and\ \ using the callback to\n confirm code execution or data exfiltration,\n (2) a security scanner (e.g. Nuclei, Gobies)\ \ is running against internal targets.\n\nInvestigate the source host, the full DNS query string (the unique subdomain prefix\ \ encodes the callback session),\nand any concurrent outbound connections or process activity to determine intent.\n" references: - https://twitter.com/breakersall/status/1533493587828260866 - https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287 - https://github.com/SigmaHQ/sigma/pull/5724#issuecomment-3466382234 - https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve author: Florian Roth (Nextron Systems), Matt Kelly (list of domains) date: 2022-06-07 modified: 2026-07-23 tags: - attack.initial-access - attack.t1190 - attack.reconnaissance - attack.t1595.002 logsource: category: dns detection: selection: query|endswith: - .burpcollaborator.net - .canarytokens.com - .ceye.io - .ddns.1443.eu.org - .ddns.bypass.eu.org - .ddns.xn--gg8h.eu.org - .digimg.store - .dns.su18.org - .dnshook.site - .dnslog.cn - .dnslog.ink - .gobygo.net - .instances.httpworkbench.com - .interact.sh - .log.dnslog.pp.ua - .log.dnslog.qzz.io - .log.dnslogs.dpdns.org - .log.javaweb.org - .log.nat.cloudns.ph - .oast.fun - .oast.live - .oast.me - .oast.online - .oast.pro - .oast.site - .oastify.com - .p8.lol - .requestbin.net filter_main_polling: query|contains: polling.oastify.com condition: selection and not 1 of filter_main_* falsepositives: - Legitimate security scanning. level: high
Near-miss passage: Sigma rule: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility. Logsource: macos / process_creation. Rule: title: Potential Persistence Via PlistBuddy id: 65d506d3-fcfe-4071-b4b2-bcefe721bbbb status: test description: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility references: - https://redcanary.com/blog/clipping-silver-sparrows-wings/ - https://www.manpagez.com/man/8/PlistBuddy/ author: Sohan G (D4rkCiph3r) date: 2023-02-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.001 - attack.t1543.004 logsource: category: process_creation product: macos detection: selection: Image|endswith: /PlistBuddy CommandLine|contains|all: - RunAtLoad - 'true' CommandLine|contains: - LaunchAgents - LaunchDaemons condition: selection falsepositives: - Unknown level: high