Browser or mail client resolving a high-risk top-level domain

Siemphony@siemphonylowT1204.001unverifiedPlaybook · Unexpected execution

Matches the egress leg of MITRE's AN0178 chain — a user-facing application resolving a name under a top-level domain associated with throwaway registrations — rather than the click itself, which no Windows event records. The process list is MITRE's BrowserParents knob verbatim (chrome.exe, msedge.exe, firefox.exe, winword.exe, outlook.exe, teams.exe); MITRE's SuspiciousTLDs knob names .top, .xyz and .monster and the remaining entries are authored here. The lineage-, download- and follow-on-execution legs of the analytic need a multi-source correlation Sigma cannot express, and a rule on the follow-on leg would be a third copy of the Office-parent-spawns-LOLBin logic already authored for T1203 and T1204, so the DNS leg is what is written. Requires Sysmon 10 or later with DNS query logging enabled and the browsers not excluded — most shipped Sysmon configurations filter EventID 22 heavily, and a filtered config returns nothing while looking healthy. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0066, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Browser or mail client resolving a high-risk top-level domain2id: 1b9f2624-7125-412c-9ed9-0fdb283bd2133status: experimental4description: |5  Matches the egress leg of MITRE's AN0178 chain — a user-facing application6  resolving a name under a top-level domain associated with throwaway7  registrations — rather than the click itself, which no Windows event records.8  The process list is MITRE's BrowserParents knob verbatim (chrome.exe,9  msedge.exe, firefox.exe, winword.exe, outlook.exe, teams.exe); MITRE's10  SuspiciousTLDs knob names .top, .xyz and .monster and the remaining entries11  are authored here. The lineage-, download- and follow-on-execution legs of the12  analytic need a multi-source correlation Sigma cannot express, and a rule on13  the follow-on leg would be a third copy of the Office-parent-spawns-LOLBin14  logic already authored for T1203 and T1204, so the DNS leg is what is written.15  Requires Sysmon 10 or later with DNS query logging enabled and the browsers16  not excluded — most shipped Sysmon configurations filter EventID 22 heavily,17  and a filtered config returns nothing while looking healthy.18  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0066, not hand-written and not tested by its author. Any lab result is on this rule's own page.19references:20  - https://attack.mitre.org/techniques/T1204/00121  - https://attack.mitre.org/detectionstrategies/DET006622author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)23date: 2026-08-1624tags:25  - attack.execution26  - attack.t1204.00127logsource:28  category: dns_query29  product: windows30detection:31  selection_client:32    Image|endswith:33      - '\chrome.exe'34      - '\msedge.exe'35      - '\firefox.exe'36      - '\winword.exe'37      - '\outlook.exe'38      - '\teams.exe'39  selection_tld:40    QueryName|endswith:41      - '.top'42      - '.xyz'43      - '.monster'44      - '.click'45      - '.zip'46      - '.mov'47  condition: selection_client and selection_tld48falsepositives:49  - "Ordinary browsing. Legitimate businesses register under .xyz and .top, and a single visit to one produces this event exactly as a phishing link does. This is the loudest entry by a wide margin and is why the rule is scoped to the six client processes rather than to every resolver on the host."50  - "Advertising, analytics and content-delivery lookups made by pages the user did not choose to visit. A single page load fans out to dozens of third-party names, so one embedded tracker on a matching TLD attributes the query to the browser with no user action behind it. MITRE's AllowedCDNs knob is the intended suppression, populated here by the analyst with the estate's own delivery and tracking domains."51  - "Link preview and safe-browsing lookups. Outlook and Teams resolve names on the user's behalf when rendering a message card, so the resolution can appear without anyone having clicked anything."52  - "Short-lived vendor and campaign domains on the same TLDs, used by marketing and event sites that staff are told to visit."53level: low

Splunk · SPL

Run this as a search.

index=* ((Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\firefox.exe" OR Image="*\\winword.exe" OR Image="*\\outlook.exe" OR Image="*\\teams.exe") AND (QueryName="*.top" OR QueryName="*.xyz" OR QueryName="*.monster" OR QueryName="*.click" OR QueryName="*.zip" OR QueryName="*.mov"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\chrome.exe" OR TO_LOWER(process.executable) LIKE "*\\\\msedge.exe" OR TO_LOWER(process.executable) LIKE "*\\\\firefox.exe" OR TO_LOWER(process.executable) LIKE "*\\\\winword.exe" OR TO_LOWER(process.executable) LIKE "*\\\\outlook.exe" OR TO_LOWER(process.executable) LIKE "*\\\\teams.exe") AND (TO_LOWER(dns.question.name) LIKE "*.top" OR TO_LOWER(dns.question.name) LIKE "*.xyz" OR TO_LOWER(dns.question.name) LIKE "*.monster" OR TO_LOWER(dns.question.name) LIKE "*.click" OR TO_LOWER(dns.question.name) LIKE "*.zip" OR TO_LOWER(dns.question.name) LIKE "*.mov"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,dns_query,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\chrome\.exe$|\\msedge\.exe$|\\firefox\.exe$|\\winword\.exe$|\\outlook\.exe$|\\teams\.exe$)</field>    <field name="QueryName" type="pcre2">(?i)(\.top$|\.xyz$|\.monster$|\.click$|\.zip$|\.mov$)</field>    <description>Browser or mail client resolving a high-risk top-level domain</description>    <mitre>      <id>T1204.001</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"category":"dns_query","product":"windows"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: dns_query / windows
Level: low
Category: office_macro_execution
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 1b9f2624-7125-412c-9ed9-0fdb283bd213

ATT&CKT1204.001

T1204.001Malicious Link

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 1 fired

The baseline holds exactly one ordinary behaviour for this log type, and the rule does not fire on it. One event is close to no evidence: this says the rule is not caught by that one behaviour, and nothing more.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1204.001, evaluated against their dns_query events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Fix the stale process names. Add \ms-teams.exe and \olk.exe, and note
Check DoH before trusting a quiet result. If Firefox and Chrome resolve
MITRE's `AllowedCDNs` knob, populated by you with the estate's delivery and
Split `.zip` and `.mov` out into a lower tier, or gate them on QueryStatus
Accept the ceiling. The six-entry TLD list is the detection; hosting the

Declared by the author

Ordinary browsing. Legitimate businesses register under .xyz and .top, and a single visit to one produces this event exactly as a phishing link does. This is the loudest entry by a wide margin and is why the rule is scoped to the six client processes rather than to every resolver on the host.
Advertising, analytics and content-delivery lookups made by pages the user did not choose to visit. A single page load fans out to dozens of third-party names, so one embedded tracker on a matching TLD attributes the query to the browser with no user action behind it. MITRE's AllowedCDNs knob is the intended suppression, populated here by the analyst with the estate's own delivery and tracking domains.
Link preview and safe-browsing lookups. Outlook and Teams resolve names on the user's behalf when rendering a message card, so the resolution can appear without anyone having clicked anything.
Short-lived vendor and campaign domains on the same TLDs, used by marketing and event sites that staff are told to visit.

Lessonoffice macro execution

office macro executionAI draft — unreviewed

01 · What this rule detects

A single Sysmon EventID 22 DNS query, where the process asking is a browser, Office app or mail client, and the name resolved ends in one of six high-risk top-level domains. Read AN0178 and count what is missing. It is an explicit four-step chain: "(1) a user-facing app launches a URL or handles a link, then (2) the same process lineage makes an outbound connection to an untrusted domain/IP, (3) a file is downloaded or unpacked to a user-writable location shortly after the click. Optional enrichment: subsequent child execution by LOLBINs." Step 1 — the click itself — is recorded by no Windows event at all. Steps 3 and 4 need a correlation across file_event and process_creation inside MITRE's TimeWindow knob (it suggests 15 minutes), which Sigma cannot express. Only step 2 survives, and only its DNS half. Say the consequence plainly, because the tag will mislead a learner: this rule is tagged attack.execution and titled under Malicious Link, but nothing in it concerns execution. A hit is evidence that a browser resolved a risky name — not that a user clicked anything, and not that anything ran.

02 · Telemetry you need

Sysmon config. EventID 22 needs Sysmon 10+ with DNS query logging on and
DNS-over-HTTPS — the bigger and quieter one. EventID 22 hooks the *Windows

03 · How the logic works

Image scopes the query to a user-facing process — that is what makes this a user-execution precursor rather than a proxy-log hygiene query. Without it every resolution on the host, from svchost.exe down, would match. endswith on QueryName anchors the TLD at the end, so top.example.com does not match while evil.top does. Attribution here is careful and worth copying. The six process names are MITRE's `BrowserParents` knob verbatim; .top, .xyz and .monster are MITRE's `SuspiciousTLDs` examples; .click, .zip and .mov are the author's. Then the reviewer's sharpest finding, which is a lesson about verbatim copying: `\teams.exe` is dead. That is the classic Teams client, out of support since 2024 and gone from current builds. Teams 2.x is ms-teams.exe, and endswith: '\teams.exe' requires the backslash immediately before the name, so it does not match. The same decay is starting on \outlook.exe — the new Outlook for Windows is olk.exe. Copying MITRE's knob verbatim is the correct attribution practice and is exactly what carried the stale binary in. Attribution and currency are separate obligations.

04 · Common false positives

Ordinary browsing. Legitimate businesses register under .xyz and .top,
`.zip` and `.mov` are also the two most-pasted file extensions on earth.
Third-party ad, analytics and CDN lookups from a page load the user never
Link-preview and safe-browsing lookups: Outlook and Teams resolve names to

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0066, never executed against a log line. Both fields are real for EventID 22 and the attribution is precise, but one of the six process selectors has not existed on a current build since 2024 — the kind of defect that validates clean and renders in three backends.
tier_2: confirm EventID 22 is collected for these images, inventory DoH, then run read-only for a fortnight and rank hits by QueryName and QueryStatus. Expect pasted filenames and ad networks to dominate; both become suppressions.
tier_3: is MITRE's actual chain — resolution, then a file write into %USERPROFILE%\Downloads or %TEMP% by the same lineage, inside the TimeWindow — a correlation engine's job, and where this stops being a hygiene query and starts being a user-execution detection.

Related detections3 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/1b9f2624-7125-412c-9ed9-0fdb283bd213

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Browser or mail client resolving a high-risk top-level domain

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it