DGA-like or Suspicious TLD DNS Resolution from NetScaler Appliance

Ibrahim Saud@tektrix

•updated Sep 28, 2026•0•0•5

Detects DNS queries originating from NetScaler appliances that exhibit algorithmically generated domain (DGA) characteristics or utilize top-level domains (TLDs) frequently associated with malicious command and control infrastructure. This rule aims to identify potential post-exploitation C2 communication following a compromise of a NetScaler ADC or Gateway appliance.