High Volume DNS Requests to Single Domain

Shadows VMB@Vemorian_Mort

•updated Aug 25, 2026•17•0•49

This rule identifies potential DNS tunneling or beaconing activity by detecting an unusually high volume of DNS queries (exceeding 50 requests) made to a specific domain name within a given timeframe. Such patterns are often associated with C2 communication or data exfiltration via the DNS protocol.