Coruna PLASMAGRID DGA Domain Query

Brandon Rodriguez@BMRodriguez

•updated Mar 18, 2026•4•0•91

This rule detects DNS queries for domains matching the pattern used by the PLASMAGRID implant's Domain Generation Algorithm (DGA). The implant, associated with the Coruna exploit kit, generates 15-character domains with a .xyz TLD as a C2 fallback mechanism.