Excessive DNS Queries

Description

Alerts when a host starts sending excessive DNS queries

Content Mapping

This content is not mapped to any local saved search. Add mapping


Use Case

Advanced Threat Detection

Category

Command and Control, Endpoint Compromise

Alert Volume

Alerts when a host starts sending excessive DNS queries

SPL Difficulty

Advanced

Journey

Stage 3

MITRE ATT&CK Tactics

Command and Control

MITRE ATT&CK Techniques

Application Layer Protocol

MITRE Threat Groups

Dragonfly 2.0
Magic Hound
Rocke

Data Sources

DNS