ALT-2415 · DNS
Beaconing DNS pattern to newly registered domain
Regular 62 second interval queries to cdn-update-sync.net with high-entropy subdomains from a single workstation.
highEscalatedconfidence 74% · 1969-12-31 19:18:00Z · rule DET-0119 Periodic DNS Beacon
Detection summary
Regular 62 second interval queries to cdn-update-sync.net with high-entropy subdomains from a single workstation.
- Affected host
- WS-HR-002
- Affected user
- svc_backup
- Source IP
- 10.20.32.70
- Detection rule
- DET-0119 Periodic DNS Beacon
- Log source
- DNS
- Assignee
- A. Pratama
Recommended actions
- Sinkhole the domain
- Inspect the endpoint for a loader
- Open an incident if paired with execution alerts
Analyst decision
Triage checklist
- 1. Confirm the detection logic matched genuine activity.
- 2. Check user and asset context for expected behaviour.
- 3. Pivot on host, user, IP and hash in the Log Explorer.
- 4. Enrich IOCs with threat intelligence.
- 5. Set a verdict and record your reasoning.