Suspicious DNS Query with Base64 Encoded String

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•37

Detects suspicious DNS queries that contain a base64 encoded string, indicated by the '==.' pattern. This pattern is often used in DNS exfiltration techniques where data is encoded in base64 and sent via DNS queries to bypass network defenses.