Newly Registered Domain Access

Use case development / Monitor Network Anomalies / Detect C2 Communications

sigma

Detection rule

title: Access to Newly Registered Domain
status: experimental
description: Detects access to domains registered in last 7 days
logsource:
  product: dns
detection:
  selection:
    domain_age_days: '<7'
  condition: selection
falsepositives:
  - Legitimate new services
level: low
tags:
  - attack.command_and_control
  - attack.t1071

Test cases

• Query domain registered yesterday

False positive guidance

Cross-reference with business justification.

Detection course