Dual-mode C2 correlation: DNS TXT tunneling and HTTP POST sharing destination domain
Correlates DNS TXT-tunneling activity and HTTP POST traffic from the same host resolving to the same base destination domain within a 2-minute window, with minimum volume thresholds on each channel, consistent with malware that branches between DNS tunneling and HTTP POST C2 modes based on the first byte of a decrypted configuration string.
Microsoft Sentinel (KQL)
