Network Connection to Dynamic IPv6 Reverse DNS Domain

Steven Lim@KQLWizard

•updated Feb 27, 2026•14•1•149

This rule detects network connections to domains that appear to be dynamically generated IPv6 reverse DNS entries. These types of domains (e.g., 'xxxxxxxxxx.ip6.arpa') are often used in command and control (C2) communications or for exfiltration by malware to evade traditional domain-based detection. The regex specifically looks for a 10-character alphanumeric string followed by '.ip6.arpa'.