DNS C2 and Exfiltration: High Volume, DGA-like Domains, TXT Record Abuse

Ankit Mehta@Secvyn

•updated Jun 30, 2026•5•0•4

Detects potential DNS-based command and control (C2) or exfiltration behavior by monitoring for DGA-like domain patterns, high-volume DNS requests, and the use of command-line tools (nslookup.exe, dnscmd.exe) to perform TXT record lookups often associated with data exfiltration.