High-Entropy Subdomain AAAA Queries

Lacey Cochrane@NullVectorX

•updated Aug 24, 2026•14•0•13

Detects DNS queries using IPv6 (AAAA) records that contain high-entropy, long subdomain strings, which are indicative of DNS tunneling techniques. The rule specifically targets patterns similar to the HOLLOWGRAPH malware, which encodes data within subdomain labels to facilitate C2 communication.