Suspicious DNS Tunneling (Mori Backdoor)

Bryant Smith@flowstate

•updated Mar 13, 2026•6•0•149

Detects potential DNS tunneling, a technique used by the Mori backdoor (associated with MuddyWater), by identifying an unusually high volume of long DNS queries from a single source. This could indicate C2 communication or data exfiltration.