Rapid multi-domain churn indicative of fast-provisioned dev-platform staging/C2 infrastructure

Duo Tech@duotech

•updated Jul 9, 2026•0•0•1

This rule monitors DNS query traffic to detect potential C2 beaconing or exfiltration attempts by identifying source IP addresses that query a high volume of unique domains within a short, one-hour time window. It triggers when a host performs at least 10 unique domain queries within 60 minutes.