Internet Connectivity Test via DNS Resolution Check

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects DNS queries to specific domains (connectivitycheck.gstatic.com or msftconnecttest.com) that are commonly used by operating systems and applications to check for internet connectivity. A high volume of such queries (threshold of 10 within 30 seconds from a single source) could indicate a network scan or unusual network activity.