ALT-2403 · DNS
Beaconing DNS pattern to newly registered domain
Regular 62 second interval queries to cdn-update-sync.net with high-entropy subdomains from a single workstation.
highNewconfidence 83% · 1969-12-31 18:52:00Z · rule DET-0119 Periodic DNS Beacon
Detection summary
Regular 62 second interval queries to cdn-update-sync.net with high-entropy subdomains from a single workstation.
- Affected host
- SRV-DC-01
- Affected user
- r.wijaya
- Source IP
- 10.20.39.51
- Detection rule
- DET-0119 Periodic DNS Beacon
- Log source
- DNS
- Assignee
- Unassigned
Recommended actions
- Sinkhole the domain
- Inspect the endpoint for a loader
- Open an incident if paired with execution alerts
Analyst decision
Triage checklist
- 1. Confirm the detection logic matched genuine activity.
- 2. Check user and asset context for expected behaviour.
- 3. Pivot on host, user, IP and hash in the Log Explorer.
- 4. Enrich IOCs with threat intelligence.
- 5. Set a verdict and record your reasoning.