Unusual Outbound Connections to Public DNS Servers on Non-Standard Ports

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•8

This rule detects unusual outbound network connections from devices to well-known public DNS servers (Google DNS, Cloudflare DNS, Quad9, OpenDNS) on ports other than the standard DNS (53), HTTP (80), or HTTPS (443) ports. A high number of such connections (5 or more within an hour) could indicate command and control activity, data exfiltration, or the use of DNS tunneling.