Detect Trojan DNS Exfiltration

Ankit Mehta@Secvyn

•updated Jun 12, 2026•1•0•5

This rule detects potential DNS exfiltration attempts by monitoring DNS query responses for specific keywords ('exfil', 'data', 'c2') in the remote DNS name. It flags devices that make 20 or more such suspicious DNS queries within an hour, indicating a high volume of potentially malicious DNS activity often associated with DNS tunneling or data exfiltration.