ATT&CK T1071.004 - DNS C2 Beaconing: High Query Rate

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects a high rate of DNS queries originating from a single source IP address within a specified time frame, which can be indicative of DNS Command and Control (C2) beaconing activity. Specifically, it triggers an alert if a source IP makes 50 or more DNS queries within a 60-second window. This behavior is often associated with malware attempting to communicate with a C2 server by encoding data within DNS requests or using DNS as a covert communication channel.