GALLIUM Artefacts - Builtin DNS Query
This rule detects DNS queries to specific malicious domains associated with the GALLIUM threat group, as identified by Microsoft Threat Intelligence Center in December 2019. The rule specifically looks for Event ID 257 in the Microsoft-Windows-DNS-Server/Analytical log, where the queried domain name (QNAME) matches a predefined list of indicators.
Sigma
