Suspicious Outbound DNS Queries for Malware/C2 Domains

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•4

This rule detects suspicious outbound DNS queries originating from a device that are not directed to common public DNS servers (Google DNS, Cloudflare DNS). The rule specifically flags queries where the remote DNS name contains keywords like 'malware', 'c2', or 'c&c', and where at least 5 such queries occur within an hour from the same device. This pattern can indicate potential malware communication or command and control (C2) activity.