This rule detects Windows DNS queries that target public wildcard DNS services which dynamically resolve subdomains to IP addresses embedded in the subdomain. Adversaries leverage these services to establish or stage infrastructure for command-and-control (C2) without registering a traditional domain, aiding evasion and attribution. The detection watches DNS query names and flags those that end with known wildcard domains (e.g., .nip.io, .sslip.io, .traefik.me, .xip.io, and related patterns). The Windows event source is DNS query data, aligning with the rule’s intention to identify anomalous domain-name resolutions originating from Windows hosts. Affirmative detections may indicate attackers using ephemeral domains to host C2 channels or phishing infrastructure. The rule is marked experimental and includes references to operational wildcard DNS services and related write-ups. False positives include legitimate developers testing local services on Windows machines without altering hosts mappings. References provided include nip.io, sslip.io, traefik.me, and a detailed write-up on wildcard DNS abuse. Tagging aligns with attack techniques related to command-and-control (T1071.004) and mitigates by monitoring suspicious wildcard-domain DNS queries from Windows hosts.