ATT&CK T1593 - Suspicious Pastebin DNS Lookup

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects suspicious DNS lookups for 'pastebin.com'. It triggers an alert if a source IP performs 5 or more DNS queries for 'pastebin.com' within a 60-second window. This activity is often associated with reconnaissance, as attackers may use Pastebin to host command and control (C2) information, exfiltrated data, or other malicious content.