Dynamic DNS / Tunneling Provider Domain Abuse
20 DNS Dynamic DNS Provider Abuse
Query
let DynDnsProviders = dynamic([
"duckdns.org", "no-ip.org", "no-ip.com", "noip.com", "hopto.org", "zapto.org",
"ddns.net", "myftp.biz", "myftp.org", "serveftp.com", "servegame.com", "sytes.net",
"ngrok.io", "ngrok-free.app", "ngrok.app", "trycloudflare.com", "loca.lt",
"portmap.io", "dnsalias.com", "dyndns.org", "afraid.org", "chickenkiller.com",
"mooo.com", "us.to", "3utilities.com", "bounceme.net", "redirectme.net"]);
ASimDnsActivityLogs
| where TimeGenerated > ago(1h)
| extend BaseDomain = strcat(tostring(split(DnsQuery, ".")[-2]), ".", tostring(split(DnsQuery, ".")[-1]))
| where BaseDomain in~ (DynDnsProviders) or DnsQuery has_any (DynDnsProviders)
| summarize
Requests = count(),
UniqueDomains = dcount(DnsQuery),
Providers = make_set(BaseDomain, 10),
SampleDomains = make_set(DnsQuery, 15),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by SrcIpAddr, SrcHostname
| where Requests > 5Explanation
This query is designed to detect potential misuse of dynamic DNS and tunneling services by internal clients. These services, such as DuckDNS, No-IP, and ngrok, are often exploited by attackers for malicious activities like command-and-control (C2) operations, phishing, and data exfiltration because they allow quick and free hostname changes without needing domain registration. The query checks DNS activity logs for any domains associated with these services within the last hour.
Here's a simplified breakdown of the query's process:
-
Dynamic DNS Providers List: It defines a list of known dynamic DNS and tunneling service providers.
-
Data Source: It uses DNS activity logs to find queries made in the last hour.
-
Domain Extraction: For each DNS query, it extracts the base domain to check if it matches any in the list of known providers.
-
Filtering: It filters the results to include only those with more than five requests to these dynamic DNS providers.
-
Summarization: It summarizes the data by source IP address and hostname, counting the number of requests, unique domains queried, and listing the providers and sample domains involved.
-
Alert Generation: If the conditions are met, it generates an alert with details about the host making the queries, the number of requests, and the domains involved.
-
Entity Mapping: It maps the source IP address and hostname to entities for further investigation.
The query helps identify suspicious DNS activity that might indicate malicious use of dynamic DNS services within a network.
Details
David Alonso
Released: July 28, 2026
Tables
Keywords
Operators
Severity
MediumTactics
Frequency: 1h
Period: 1h