Bluekit PhaaS Fast-Flux DNS: Single Host Resolving to Many IPs in Short Window
This rule detects potential Bluekit PhaaS C2 infrastructure by identifying fast-flux DNS behavior. It monitors DNS queries for domains associated with Bluekit phishing campaigns and flags instances where a single hostname resolves to a high number of distinct IP addresses (3 or more) within a one-hour window, which is indicative of domain rotation for evasion.
Cortex XDR
