High Volume DNS Queries to Non-Standard Domains (Potential DNS Beaconing)

Ankit Mehta@Secvyn

•updated Jun 17, 2026•1•0•3

This rule detects devices making a high volume of DNS queries (50 or more within a 5-minute window) to domains that have 4 or more subdomains and are not common legitimate services like microsoft.com, google.com, or amazon.com. This pattern can be indicative of DNS beaconing, a technique used by adversaries for command and control (C2) communication or data exfiltration.