Dynamic C2 Domain Resolution Pattern Detected

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects a pattern of dynamic DNS queries that could indicate Command and Control (C2) activity. Specifically, it triggers an alert if a single source IP address makes 50 or more DNS queries within a 60-second window. This high frequency of DNS lookups from a single source is often characteristic of malware attempting to resolve dynamically generated C2 domains.