Base64 Payload in DNS TXT Record Response

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects DNS TXT record responses containing a Base64 encoded payload of at least 60 characters. This pattern is often used by malware for command and control (C2) communication or data exfiltration, leveraging DNS tunneling to evade detection.