Connection to Dynamic DNS Provider by a Signed Binary Proxy

sequence by process.entity_id with maxspan=5m
  [process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
    (
     process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
                     "powershell.exe", "pwsh.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe",
                     "installutil.exe","RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe", "msiexec.exe",
                     "scp.exe", "ssh.exe") or
     process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
                           "?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe") or

     (process.executable : "?:\\Windows\\Microsoft.NET\\*.exe" and not (process.name:"dfsvc.exe" and process.parent.name : "rundll32.exe"))
     )
  ]
  [dns where
    dns.question.name :
         (
          "*.no-ip.com",
          "*.no-ip.org",
          "*.no-ip.biz",
          "*.no-ip.info",
          "*.noip.com",
          "*.afraid.org",
          "*.changeip.com",
          "*.ddns.net",
          "*.dyndns.org",
          "*.hopto.org",
          "*.zapto.org",
          "*.servehttp.com",
          "*.sytes.net",
          "*.myftp.biz",
          "*.myftp.org",
          "*.ddnsfree.com",
          "*.duckdns.org",
          "*.000webhostapp.com",
          "*.myddns.me",
          "*.dlinkddns.com",
          "*.chickenkiller.com",
          "*.thddns.net",
          "*.linkpc.net",
          "*.gotdns.ch",
          "*.dynv6.net",
          "*.dns.army",
          "*.dns.navy",
          "*.v6.army",
          "*.v6.navy",
          "*.v6.rocks",
          "*.dyndns-office.com",
          "*.myvnc.com",
          "*.is-certified.com"
         ) and

     /* covered by rule Id 51894221-7657-4b56-9406-e080e19ad159 */
    not dns.question.name : "checkip.dyndns.org" and
    not dns.question.name : ("www.duckdns.org")
  ]