Network Connection to Known Dead Drop Resolvers from Non-Browser Processes

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•4

This rule detects network connections to known dead drop resolver domains (letsdiskuss.com or digitalpoint.com) that originate from processes other than common web browsers (Chrome, Edge, Firefox, Internet Explorer). This behavior is indicative of command and control (C2) activity where malware uses legitimate web services to retrieve further instructions or C2 infrastructure details.