Junk Data Padding in DNS Query for C2 Obfuscation
This rule detects DNS queries that contain unusually long, seemingly random strings (50 or more alphanumeric characters) in the query name. This pattern is often used by malware for Command and Control (C2) communication, where the long string serves as 'junk data padding' to obfuscate the actual C2 data or to make detection more difficult. The rule specifically looks for DNS queries (port 53) and applies a threshold to prevent excessive alerts from a single source, triggering if 5 such queries are observed within 30 seconds from the same source IP.
Suricata
