Mohamad Amin Bin A Hamid
@aminhamid910 followers4 downloads21 copies0 likes466 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
1
1
1
Platforms
1
Products / Services
1
1
MITRE Techniques
1
1
1
1
1
This detection identifies network connections to external DNS servers over TCP (port 53) initiated by common scripting engines like PowerShell, Python, or WScript. While DNS over TCP is a valid protocol, it is less common for standard queries and is often used by malware for command and control (C2) or data exfiltration through DNS tunneling.
