DNS Calculation C2 Using IP Math from TXT Record

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects DNS queries for TXT records that contain specific patterns indicative of DNS calculation C2 (Command and Control) activity. The pattern searched for is a PCRE regex matching two alphanumeric strings, each 4 to 8 characters long, separated by a dot (e.g., 'abcd.efgh.'). This type of activity is often associated with malware using DNS TXT records to encode C2 instructions or data, potentially involving IP math for dynamic C2 server resolution. The rule includes a threshold to prevent excessive alerts, triggering if 5 such queries are observed from the same source within 60 seconds.