ATT&CK T1102 - C2 via Pastebin Lookup

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects DNS queries for 'pastebin.com'. This activity is often associated with Command and Control (C2) communication, where attackers use services like Pastebin to host malicious code, configuration data, or receive commands. The rule triggers if 10 such queries are observed from the same source IP within a 300-second (5-minute) window, indicating potential C2 activity or data exfiltration attempts.