Dns-Query - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/dns-query/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 24 Jul 2026 09:10:19 +0000Malware Employs Web Services for Victim IP Reconnaissancehttps://feed.craftedsignal.io/briefs/2026-07-malware-ip-reconnaissance/Fri, 24 Jul 2026 09:10:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-malware-ip-reconnaissance/Malware, including Trickbot and various stealers, utilizes DNS queries to public IP checking web services for reconnaissance purposes, aiming to determine the victim's external IP address, which can facilitate further attacks or lateral movement.Threat actors deploy malware, such as Trickbot, Azorult, DarkCrystal RAT, and other information stealers, that perform reconnaissance by querying public web services to ascertain the victim machine's external IP address. This activity, identifiable through Sysmon Event ID 22 logs, involves processes initiating DNS requests to a predefined list of IP-checking domains like "wtfismyip.com," "ipinfo.io," and "icanhazip.com." This behavior is a common preliminary step for malware to gather environmental information, which is crucial for subsequent attack phases such as command and control (C2) communication, target profiling, or planning lateral movement within a compromised network. Detecting such reconnaissance early allows defenders to identify potentially malicious activity before more damaging stages of an attack unfold.

Attack Chain

  1. Malware successfully executes on the victim's Windows endpoint, typically delivered via phishing or drive-by download.
  2. The malicious process initiates internal reconnaissance to identify initial system characteristics and prepares to determine its external network presence.
  3. The malware constructs a DNS query for a known public IP address checking web service, such as ipecho.net or api.ipify.org.
  4. The operating system's DNS resolver processes this query, attempting to resolve the domain to an IP address.
  5. Upon successful resolution, the malware receives the IP address of the external IP checking service.
  6. The malware establishes an outbound network connection to the resolved IP address to communicate with the IP checking web service.
  7. The IP checking service responds with the victim's external public IP address, which the malware parses and extracts.
  8. The malware leverages this newly acquired external IP for various purposes, including reporting to its C2 server or tailoring subsequent attack steps like targeting specific external infrastructure.

Impact

Successful IP reconnaissance by malware allows threat actors to gain critical network context about their victims. This information can be used to bypass network security controls, establish more reliable command and control channels, or tailor subsequent attack stages, such as targeting specific external-facing services or planning lateral movement from an internet-facing host. While this activity alone does not directly cause immediate data loss or system compromise, it is a foundational step for many malware families, making its detection vital for early threat intervention and preventing more severe consequences like data exfiltration, ransomware deployment, or widespread network compromise.

Recommendation

  • Deploy the Detect Malware IP Reconnaissance via DNS Queries Sigma rule to your SIEM and configure Sysmon to log Event ID 22 for DNS queries.
  • Monitor for DNS queries to the domains listed in the IOC table and investigate any hits, especially from non-browser processes.
  • Tune the Detect Malware IP Reconnaissance via DNS Queries rule by creating allowlists for known legitimate applications, such as internet browsers, that might query these services, as noted in the rule's falsepositives.
]]>mediumadvisoryreconnaissancemalwaredns-querywindows