ATT&CK T1490 - Ransomware Known C2 TLD Pattern

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects DNS queries for domains ending with '.onion', which are typically associated with the Tor network. In the context of ransomware, this pattern can indicate communication with Command and Control (C2) servers hosted on the dark web, often used for exfiltration or receiving further instructions.