DNS Query to Known Malicious C2 Domains (Axios Attack)

Ali AlEnezi@site

•updated Apr 4, 2026•6•0•111

This rule detects DNS resolution requests to specific malicious command and control (C2) domains, 'sfrclak.com' and 'callnrwise.com', which have been linked to the 'Axios attack'. Detection of these domains indicates potential compromise and active C2 communication.