DNS C2 DGA Beaconing - High-Frequency Random Subdomain NXDomain Flood
Detects high-frequency DNS queries for long, random-looking subdomains that result in NXDomain responses, a behavioral indicator of malware using Domain Generation Algorithms (DGA) for command-and-control beaconing.
Suricata
