Unusual Volume of DNS Queries from a Single Device
This rule detects an unusually high volume of DNS queries originating from a single device within a one-hour window. This behavior can be indicative of various malicious activities such as DNS tunneling for command and control, data exfiltration, or extensive reconnaissance.
Microsoft Sentinel (KQL)
