DNS Query To Recently Created Domain
This rule detects DNS queries to domains that have been created within the last 30 days. This behavior can be indicative of newly registered malicious domains used for command and control, phishing, or other adversarial activities. The rule correlates DNS query events with WHOIS data to identify the domain creation time.
YARA-L
