RedTail DNS-over-TLS C2 connection to anomalous resolver

Arnold Chan@slaz

•updated Sep 11, 2026•0•0•1

Detects established outbound network connections on TCP port 853 (DNS-over-TLS) to known C2 infrastructure associated with the RedTail malware. The rule monitors for both connection attempts to anomalous resolvers and specific TLS handshake patterns characteristic of RedTail C2 activity.