DNS Query To Devtunnels Domain
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. Devtunnels can be used for command and control or data exfiltration by tunneling traffic over legitimate-looking DNS requests.
Sigma
