OP-512 DNS C2 Query Detection

Kaung Khant Ko@kaungkhantko

•updated Jun 9, 2026•1•0•2

This rule detects DNS queries associated with the OP-512 threat cluster, specifically looking for requests to 'hcgos.com' and 'lhlsjcb.com'. It identifies a hex-segmented pattern used for reporting web shell deployment locations and also explicitly checks for the 'ashx.lhlsjcb.com' subdomain, indicating potential command and control activity.