INTERLOCK NodeSnake RAT DNS lookup (terezo-kb.org)

Collin Lairamore@Bollinmore

•updated Jul 28, 2026•0•0•0

This rule detects DNS queries for the domain 'terezo-kb.org', which is associated with the NodeSnake Remote Access Trojan (RAT), often utilized by the INTERLOCK ransomware group for command and control (C2) communication.