DNS C2 Beaconing — Low-TTL Periodic Domain Lookups
02 DNS C2 Beaconing Periodic
Query
ASimDnsActivityLogs
| where TimeGenerated > ago(4h)
| where EventResult =~ "Success"
| where DnsQueryTypeName in~ ("A", "AAAA", "TXT", "MX", "CNAME", "NULL")
| where not(DnsQuery has_any (dynamic(["msftconnecttest","windowsupdate","ctldl.windowsupdate","update.microsoft","telemetry","ocsp","time.windows","events.data.microsoft","office365","officeapps.live","microsoftonline","googleapis","gvt1","gvt2","gstatic","clients.google","push.apple","itunes.apple","cloudfront.net","akamaiedge","akadns","edgekey","edgesuite"])))
| summarize
QueryCount = count(),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated),
SrcHostname = any(SrcHostname)
by SrcIpAddr, DnsQuery
| where QueryCount >= 50
| extend
SpanMinutes = datetime_diff('minute', LastSeen, FirstSeen),
QueriesPerMin = round(todouble(QueryCount) / max_of(1, datetime_diff('minute', LastSeen, FirstSeen)), 2)
| where SpanMinutes > 30
| where QueriesPerMin >= 1Explanation
This query is designed to detect suspicious DNS activity that may indicate command-and-control (C2) beaconing, a technique often used by malware to communicate with external servers. Here's a simplified breakdown of what the query does:
-
Purpose: It identifies clients (computers or devices) that repeatedly query the same external domain at regular intervals, which is a common sign of automated C2 communication.
-
Detection Criteria:
- The query looks at DNS activity logs over the past 4 hours.
- It focuses on successful DNS queries of specific types (e.g., A, AAAA, TXT).
- It excludes known safe domains related to Microsoft, Google, Apple, etc., to avoid false positives.
- It flags any client that queries the same domain 50 or more times within this period.
-
Analysis:
- It calculates the time span between the first and last query and the average number of queries per minute.
- It only considers cases where the querying spans more than 30 minutes and occurs at least once per minute on average.
-
Alert Generation:
- If the criteria are met, an alert is generated with details such as the hostname, IP address, queried domain, total query count, and the rate of queries per minute.
- The alert is labeled as high severity due to the potential risk of C2 activity.
-
Use Cases:
- This query is useful for detecting potential threats from malware using DNS for C2 communication, including tools like Cobalt Strike, Silver, and Havoc.
Overall, this query helps security teams identify and investigate potential malicious activity by monitoring DNS queries for patterns indicative of automated C2 beaconing.
Details
David Alonso
Released: July 28, 2026
Tables
Keywords
Operators
Severity
HighTactics
Frequency: 4h
Period: 4h