DNS C2 Beaconing - Many Queries

Detects a high count of DNS queries from a single source IP to a specific query name, indicating potential C2 beaconing.

Sigma