Outbound Agentic Request to Fictitious Webhook/API Domain (Phantom Endpoint)

Duo Tech@duotech

•updated Jul 9, 2026•0•0•8

This rule monitors network DNS queries for patterns commonly associated with webhook notification services or potential C2 infrastructure. It looks for specifically formatted domains (e.g., 'api.[random]-notifier.[tld]', 'build-notifier' substrings, or custom API subdomains on common cloud-native TLDs) which may indicate the use of webhook services for data exfiltration or adversary command and control.