ATT&CK T1048 - DNS Exfiltration: High Volume TXT Queries

Darshan Thummar@Mighty

•updated Jun 10, 2026•2•0•3

This rule detects a high volume of DNS TXT queries originating from the home network to any destination on port 53. This behavior is indicative of potential DNS exfiltration, where data is encoded and transmitted via DNS TXT records. The rule triggers an alert if 30 or more TXT queries are observed from a single source within a 60-second window.