DNS Request for Middle Eastern Themes with Suspicious TLDs
This rule detects DNS requests for domain names that combine Middle Eastern-themed keywords (dubai, emirates, iran, saudi, etisalat) with suspicious or cheap Top-Level Domains (TLDs) such as .top, .cyou, .click, .life, .mom, .sbs, or .xyz. This pattern can indicate potential phishing attempts, malicious infrastructure, or C2 communication attempting to blend in with legitimate traffic by using seemingly relevant but low-cost domains.
CQL
