AK47C2 Backdoor DNS C2 Communication
This rule detects potential DNS command and control (C2) activity from the AK47C2 backdoor. The backdoor communicates by sending long, hex-encoded strings as subdomains to a C2 server, specifically targeting a typosquatted domain of 'updatemicfosoft.com'. The rule identifies these communications by checking for the specific C2 domain, a subdomain length greater than 40 characters, and the subdomain consisting of hex characters with optional prefixes 's', '1', '2', 'a'.
Microsoft Sentinel (KQL)
