[IC] - Detect unusual/suspicious TTL values based on DNS Answers

Sergio Albea@Sergio_Albea

•updated Sep 12, 2025•12•0•122

Time to live (TTL) values in DNS responses provide valuable threat-hunting insights, including: - Fast-flux botnets (rotating IPs with low TTLs). - Malware C2 detection (extremely low TTLs). ( | where TTLs < 10 ) - DNS tunneling (high TTLs or changing TTLs). ( | where TTLs > 86400 ) - Fake domains mimicking real services (TTL anomalies). - Evasive infrastructure constantly changing TTL values. You can use the following KQL Query to search for the mentioned cases.