APT and Ransomware Malicious Domain Resolution

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•4

This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.