THREAT-ResourceDev-DynamicDNSHostedAdversaryInfra Splunk · SPL

Detect Free Dynamic DNS Hostnames Used as Actor-Acquired C2 Infrastructure Contacted by Non-Browser Processes in Splunk

Adversaries acquire infrastructure by registering free hostnames at dynamic DNS (DDNS) providers such as DuckDNS, No-IP, Dynu and FreeDNS-style domains (ddns.net, hopto.org, zapto.org, sytes.net, myftp.biz). These services cost nothing, need no domain registration or WHOIS record, and let an actor repoint a stable name at disposable VPS or residential IPs — which is why commodity RATs (njRAT, AsyncRAT, Remcos, NanoCore) and state-linked clusters hard-code DDNS names for C2 and payload staging. Legitimate use of these domains by enterprise endpoints is rare and is overwhelmingly performed by browsers or known remote-access tools. The detection therefore looks for DNS resolutions and outbound connections to well-known DDNS suffixes initiated by non-browser processes (scripts, LOLBins, unsigned binaries, Office children), then enriches with process path, account and resolved IPs so analysts can prioritize by prevalence and parent lineage. Because the infrastructure is attacker-acquired before any intrusion step, hits are strong early indicators of implant beaconing or stager retrieval.

MITRE ATT&CK

Tactic
Resource Development

SPL Detection Query

Splunk (SPL)
spl 
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
| eval q=lower(QueryName)
| where match(q, "(duckdns\.org|no-ip\.com|no-ip\.org|ddns\.net|hopto\.org|zapto\.org|servehttp\.com|sytes\.net|myftp\.biz|serveftp\.com|redirectme\.net|gotdns\.ch|dynu\.net|freedns\.afraid\.org)$")
| where NOT match(lower(Image), "(chrome|msedge|firefox|brave|opera|iexplore)\.exe$")
| stats count as QueryCount, min(_time) as FirstSeen, max(_time) as LastSeen, values(QueryResults) as ResolvedIPs by host, User, Image, QueryName
| sort - QueryCount
medium severity medium confidence

Sysmon Event ID 22 DNS query detection for free DDNS suffixes where the querying image is not a browser. Requires Sysmon DNS query logging.

Data Sources

Network Traffic: DNS ResolutionSysmon Event ID 22

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

  • Administrators and home-lab users running legitimate remote-access or camera/NAS software that registers a free dynamic DNS hostname
  • Software updaters or IoT management agents that call a vendor-provided DDNS hostname
  • Authorized red team or penetration testing infrastructure that uses dynamic DNS names
  • Developers exposing a test service through a free DDNS name for a demo

Other platforms for THREAT-ResourceDev-DynamicDNSHostedAdversaryInfra

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Resolve and Connect to a DuckDNS Hostname from PowerShell

    Expected signal: Sysmon Event ID 22 with Image=powershell.exe and QueryName=atomic-test-1003.duckdns.org; MDE DeviceNetworkEvents row with InitiatingProcessFileName=powershell.exe and a duckdns.org RemoteUrl if resolution succeeds.

  2. Test 2 Linux curl to No-IP Hostname

    Expected signal: DNS lookup for atomic-test-1003.hopto.org originating from the curl process; EDR network event on Linux if the name resolves.

Last updated: 2026-10-19 Research depth: deep
References (3)

Response Playbook

Triage

  1. Identify the initiating process (Image/InitiatingProcessFileName), its full path, signer and hash; treat unsigned binaries in user-writable paths (AppData, Temp, ProgramData, Downloads) as high priority.
  2. Review the parent process chain — Office apps, script hosts (wscript, mshta, powershell) or archive extractors spawning the process strongly indicate a malware stager.
  3. Check beacon periodicity of the connections to the DDNS hostname; regular intervals with small payloads suggest C2 rather than a user-installed remote tool.
  4. Resolve the hostname and review historical A records via passive DNS; rapid IP changes or hosting on VPS/residential ranges support malicious use.
  5. Determine whether the hostname belongs to an approved remote-access, camera or NAS product owned by the user or IT before escalating.
  6. Search the environment for other hosts querying the same DDNS hostname or resolved IPs to scope the compromise.

Containment

  1. Block the DDNS hostname and resolved IPs at DNS filtering, proxy and firewall layers.
  2. Isolate the affected endpoint using EDR network containment if the process is unsigned or has a suspicious parent.
  3. Terminate the process and preserve a memory image before remediation.
  4. Reset credentials for the user account active on the host and review for lateral movement.

Evidence Collection

  1. DNS and proxy logs for the hostname across all hosts for the previous 30 days.
  2. Process creation events, file hash, signer and on-disk copy of the initiating binary.
  3. Network flow records showing connection timing, byte counts and destination ports.
  4. Persistence artefacts: Run keys, scheduled tasks, services and startup folder entries tied to the process.

Escalation Criteria

  • !Unsigned or LOLBin-spawned process beaconing to a DDNS hostname at regular intervals.
  • !Multiple hosts contacting the same DDNS hostname.
  • !Follow-on activity such as credential access, discovery commands or data staging from the same host.

Investigation Guide

Related Techniques

T1583.001 — Acquire Infrastructure: Domains (parent technique)T1568 — Dynamic ResolutionT1071.001 — Application Layer Protocol: Web ProtocolsT1102 — Web Service

Forensic Artifacts

  • >Sysmon Event ID 22 DNS query records with Image and QueryName fields.
  • >MDE DeviceNetworkEvents rows with RemoteUrl, InitiatingProcessFolderPath and RemoteIP.
  • >Windows DNS client cache (ipconfig /displaydns) on the endpoint.
  • >Persistence locations referencing the initiating binary (HKCU Run keys, scheduled tasks).

Tuning Guidance

Build an allowlist of approved DDNS hostnames (e.g. IT-owned NAS or camera systems) keyed by hostname and initiating process. Add known remote-management tools to the process exclusion list. Consider raising severity when the initiating process is unsigned, resides in a user-writable path, or was spawned by an Office/script host. Extend the DDNS suffix list from provider documentation as new suffixes emerge.

Hunting Queries

30-day prevalence hunt across all DDNS hostnames: names contacted by few hosts via unusual processes are the best leads, while names seen widely usually map to legitimate products.

Hunting — KQL
kql 
let DdnsSuffixes = dynamic(["duckdns.org","no-ip.com","ddns.net","hopto.org","zapto.org","sytes.net","dynu.net"]);
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (DdnsSuffixes)
| summarize Devices=dcount(DeviceName), Conns=count(), Procs=make_set(InitiatingProcessFileName, 10) by RemoteUrl
| order by Devices desc
Hunting — SPL
spl 
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
| where match(lower(QueryName), "(duckdns\.org|no-ip\.(com|org)|ddns\.net|hopto\.org|zapto\.org|sytes\.net|dynu\.net)$")
| stats dc(host) as Devices, count as Queries, values(Image) as Procs by QueryName
| sort - Devices

Atomic Red Team Tests

Test 1 Resolve and Connect to a DuckDNS Hostname from PowerShell
windows

Simulates implant behaviour by having a non-browser process (powershell.exe) resolve a hostname under a free DDNS suffix and attempt an HTTP connection.

Command

powershell 
Resolve-DnsName atomic-test-1003.duckdns.org -ErrorAction SilentlyContinue; try { Invoke-WebRequest -Uri http://atomic-test-1003.duckdns.org -TimeoutSec 5 -UseBasicParsing } catch {}

Cleanup

powershell 
Clear-DnsClientCache

Expected Telemetry

Sysmon Event ID 22 with Image=powershell.exe and QueryName=atomic-test-1003.duckdns.org; MDE DeviceNetworkEvents row with InitiatingProcessFileName=powershell.exe and a duckdns.org RemoteUrl if resolution succeeds.

Expected Detection

KQL and SPL queries flag powershell.exe contacting a *.duckdns.org hostname because the initiating process is not a browser.

Test 2 Linux curl to No-IP Hostname
linux

Uses curl to resolve and request a hostname under a No-IP DDNS suffix, producing DNS and network telemetry from a non-browser process.

Command

bash 
curl -m 5 http://atomic-test-1003.hopto.org/ || true

Expected Telemetry

DNS lookup for atomic-test-1003.hopto.org originating from the curl process; EDR network event on Linux if the name resolves.

Expected Detection

Elastic EQL, Chronicle and CQL rules match the hopto.org suffix from a non-browser process on endpoints that forward DNS telemetry.

Related Detections

Tactic Hub

TA0042 Resource Development

Detection Variants (3)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Parent Technique

T1583.001 Domains

Related Techniques

T1583.001 Domains T1568 Dynamic Resolution T1071.001 Web Protocols T1102 Web Service

Same Tactic: Resource Development

Popular Detections