All Detections

DNS C2 Activity

avatar
Vashrith Vinodh@Vash
updated Aug 16, 20264031

Identifies DNS queries to a known malicious C2 domain and summarizes activity by client IP, including the first and last observed query and total query count.

Microsoft Sentinel (KQL)