CI/CD or AI Agent Process DNS Query to Webhook/API Phantom Domain
Detects unusual DNS requests initiated by common development, scripting, and administrative tools (e.g., node, python, powershell, curl) to domains that follow patterns often used for webhooks, relays, or command-and-control services. The rule specifically excludes common package management or source code repositories to reduce noise.
CQL
