High Volume DNS Queries to Non-Standard Domains
This rule detects a high volume of DNS queries (over 50) from a single source IP to a limited number of destination IPs (2 or less) for non-standard domains. It excludes common legitimate domains like microsoft.com, google.com, apple.com, cloudflare.com, akamai.com, and amazonaws.com, as well as queries to private IP ranges. This pattern can indicate DNS tunneling, data exfiltration, or command and control activity.
Splunk (SPL)
