High-Volume Queries to Abused / Suspicious TLDs
21 DNS Suspicious TLD Volume
Query
let SuspiciousTlds = dynamic([
"zip", "mov", "xyz", "top", "gq", "tk", "ml", "cf", "ga", "work", "click",
"country", "kim", "science", "party", "review", "loan", "download", "stream",
"racing", "fit", "cam", "rest", "mom", "cfd", "sbs", "lol", "quest", "cyou", "buzz"]);
ASimDnsActivityLogs
| where TimeGenerated > ago(1h)
| extend Tld = tostring(split(tolower(DnsQuery), ".")[-1])
| where Tld in (SuspiciousTlds)
| summarize
Requests = count(),
UniqueDomains = dcount(DnsQuery),
Tlds = make_set(Tld, 15),
SampleDomains = make_set(DnsQuery, 15),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by SrcIpAddr, SrcHostname
| where UniqueDomains > 10Explanation
This query is designed to detect unusual activity related to domain name resolutions that might indicate malicious behavior. Here's a simplified breakdown:
-
Purpose: The query identifies computers (clients) that are resolving a large number of different domain names within certain top-level domains (TLDs) that are known for being frequently abused. These TLDs include ".zip", ".mov", ".xyz", ".top", and others, as well as some free country code TLDs like ".tk" and ".ml".
-
Detection Criteria: If a single host resolves more than 10 unique domain names under these suspicious TLDs within an hour, it could be a sign of malicious activity such as:
- Domain Generation Algorithms (DGA) used by malware to create new domains.
- Command and Control (C2) server communication.
- Phishing attacks using redirect chains.
-
Data Source: The query uses DNS activity logs from Windows DNS (via the WindowsDnsAma connector).
-
Alert Generation: When the criteria are met, an alert is generated. The alert includes details such as the hostname and IP address of the client, the number of unique domains resolved, the total number of DNS queries made, and a sample of the domains queried.
-
Severity and Techniques: The severity of this alert is marked as "Medium". It is associated with MITRE ATT&CK techniques T1071.004 (DNS) and T1568.002 (Domain Generation Algorithms).
-
Customization: Users can adjust the list of suspicious TLDs and the threshold for unique domains to better fit their network's baseline activity.
Overall, this query helps in identifying potential security threats by monitoring DNS query patterns that deviate from normal behavior, focusing on TLDs that are often used in cyber attacks.
Details
David Alonso
Released: July 28, 2026
Tables
Keywords
Operators
Severity
MediumTactics
Frequency: 1h
Period: 1h