DPRK Threat Actor C2 Communication DNS Indicators

SigmaHQ Detections@sigmaHQ

•updated Jan 6, 2025•0•23

Detects DNS queries for specific command and control (C2) domains known to be used by DPRK (Democratic People's Republic of Korea) threat actors. The rule specifically looks for 'connection.lockscreen.kro.kr' and 'updating.dothome.co.kr' in DNS query names.