DNS query to known dynamic DNS (DDNS) provider domains (Ousaban C2 rotation)

Duo Tech@duotech

•updated Jul 2, 2026•0•0•2

This rule detects repeated DNS queries to known Dynamic DNS (DDNS) providers within a 24-hour window, which may indicate an infected host beaconing to a command-and-control (C2) server utilizing dynamic infrastructure. Such rotation is commonly used by malware to maintain connectivity if primary infrastructure is blocked.