BRICKSTORM DoH C2 - TLS Beaconing to 8.8.8.8 or 1.1.1.1 on Port 443 from Edge Appliances
This rule identifies potential BRICKSTORM command and control (C2) activity by detecting sustained beaconing patterns to known public DNS-over-HTTPS (DoH) providers (8.8.8.8, 1.1.1.1) over port 443. It buckets network connections into 10-minute windows and flags source devices exhibiting frequent, repetitive traffic patterns, enriched with asset context to prioritize alerts from edge appliances such as firewalls, NAS devices, or storage sync services.
Splunk (SPL)
