DGA Bulk NXDOMAIN Responses Indicating Beaconing

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects a high volume of DNS NXDOMAIN (Non-Existent Domain) responses originating from a single source IP address within a short timeframe. This pattern is indicative of Domain Generation Algorithm (DGA) activity, often used by malware for command and control (C2) beaconing. The threshold is set to trigger if 20 NXDOMAIN responses are observed from the same source within 60 seconds.