Query: detection rule: Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains. These services (
Matching passage: Sigma rule: Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains. These services (. Logsource: dns. Rule: title: DNS Query to External Service Interaction Domains id: aff715fa-4dd5-497a-8db3-910bea555566 status: test description: "Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains.\nThese\ \ services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security\nresearchers and attackers\ \ alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and\nLog4Shell-style injections, where the exploit\ \ payload triggers an external DNS lookup to a controlled domain.\n\nA detection indicates that a host on your network resolved\ \ one of these domains, which may mean:\n (1) an attacker is actively probing or exploiting a vulnerable service and\ \ using the callback to\n confirm code execution or data exfiltration,\n (2) a security scanner (e.g. Nuclei, Gobies)\ \ is running against internal targets.\n\nInvestigate the source host, the full DNS query string (the unique subdomain prefix\ \ encodes the callback session),\nand any concurrent outbound connections or process activity to determine intent.\n" references: - https://twitter.com/breakersall/status/1533493587828260866 - https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287 - https://github.com/SigmaHQ/sigma/pull/5724#issuecomment-3466382234 - https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve author: Florian Roth (Nextron Systems), Matt Kelly (list of domains) date: 2022-06-07 modified: 2026-07-23 tags: - attack.initial-access - attack.t1190 - attack.reconnaissance - attack.t1595.002 logsource: category: dns detection: selection: query|endswith: - .burpcollaborator.net - .canarytokens.com - .ceye.io - .ddns.1443.eu.org - .ddns.bypass.eu.org - .ddns.xn--gg8h.eu.org - .digimg.store - .dns.su18.org - .dnshook.site - .dnslog.cn - .dnslog.ink - .gobygo.net - .instances.httpworkbench.com - .interact.sh - .log.dnslog.pp.ua - .log.dnslog.qzz.io - .log.dnslogs.dpdns.org - .log.javaweb.org - .log.nat.cloudns.ph - .oast.fun - .oast.live - .oast.me - .oast.online - .oast.pro - .oast.site - .oastify.com - .p8.lol - .requestbin.net filter_main_polling: query|contains: polling.oastify.com condition: selection and not 1 of filter_main_* falsepositives: - Legitimate security scanning. level: high
Near-miss passage: Sigma rule: Detects attempts to disable the Windows Firewall using PowerShell. Logsource: windows / process_creation. Rule: title: Windows Firewall Disabled via PowerShell id: 12f6b752-042d-483e-bf9c-915a6d06ad75 related: - id: 488b44e7-3781-4a71-888d-c95abfacf44d type: similar status: test description: Detects attempts to disable the Windows Firewall using PowerShell references: - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html author: Tim Rauch, Elastic (idea) date: 2022-09-14 modified: 2023-02-13 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: - \powershell.exe - \pwsh.exe - \powershell_ise.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_args: CommandLine|contains|all: - 'Set-NetFirewallProfile ' - ' -Enabled ' - ' False' selection_opt: CommandLine|contains: - ' -All ' - Public - Domain - Private condition: all of selection_* falsepositives: - Unknown level: medium