DGA fallback C2: high NXDOMAIN volume from randomized domain queries

Emiliano Mema@Nosalva

•updated Aug 21, 2026•9•1•5

Detects DNS queries containing high-entropy domain labels that exhibit patterns common to Domain Generation Algorithms (DGA). The rule triggers when a threshold of such suspicious queries is exceeded from a single source within a 60-second window, which is a common indicator of malware beaconing or C2 communication.