Low Prevalence DNS Domain Query

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•1•0•35

This rule detects DNS queries for domains that have a very low rolling maximum prevalence (3 or less over a 10-day period). This can indicate newly registered domains, domains used for command and control, or other suspicious activity that has not yet gained widespread legitimate use. The rule correlates DNS events with derived prevalence data to identify these low-prevalence domains.