Fileless Payload Stored in DNS TXT Record

Darshan Thummar@Mighty

•updated Jun 11, 2026•6•0•5

This rule detects DNS queries for TXT records that contain a long, base64-encoded string, which could indicate a fileless payload being stored or retrieved via DNS. The rule specifically looks for TXT records with content matching a regular expression for base64-encoded strings of at least 80 characters.