DNS query matching CAV3RN C2 configuration recovery pattern (cloudlanecdn.com)

Duo Tech@duotech

•updated Jul 21, 2026•0•0•8

Detects DNS queries matching the pattern used by the CAV3RN C2 infrastructure. The rule identifies specific subdomains under 'cloudlanecdn.com' that follow a structured format consistent with C2 configuration recovery and heartbeat beacons, specifically looking for a hex-encoded timestamp pattern.