DeviceManager DNS tunneling: high-volume TXT/A queries to Microsoft-telemetry-mimicking domains

Duo Tech@duotech

•updated Aug 6, 2026•4•0•3

Detects high-volume DNS TXT/A queries to domains containing "microsoft" within a 1-hour window per host, indicative of DeviceManager RAT DNS tunneling activity disguised as Microsoft telemetry traffic.