DeviceManager DNS tunneling C2 channel - high volume TXT/A queries to Microsoft-telemetry-mimicking domain from single host

Duo Tech@duotech

•updated Aug 6, 2026•3•0•0

Detects high-volume DNS TXT/A queries from a single internal host to a domain containing "microsoft" or "telemetry" keywords, indicative of DeviceManager RAT DNS tunneling C2 channel abuse designed to mimic legitimate Microsoft telemetry traffic.