C2 Traffic DNS Detection Rule

Wen Ray@wenray

•updated Jul 17, 2025•11•4•162

Detects network connections using DNS over TLS (DoT) on port 853 or DNS over HTTPS (DoH) to known public resolvers from non-browser processes. This activity can indicate an attempt to bypass network security controls and monitoring by hiding DNS queries within encrypted traffic.