← Back to SOC feed Coverage →

Communications use DNS

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-04-21T09:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use DNS communications to exfiltrate data or establish command and control channels, which is a common tactic in malware operations. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential covert network activity and mitigate advanced threats.

YARA Rule

rule network_dns {
    meta:
        author = "x0r"
        description = "Communications use DNS"
	version = "0.1"
    strings:
        $f1 = "System.Net"
        $f2 = "Ws2_32.dll" nocase
        $f3 = "Dnsapi.dll" nocase
        $f4 = "wsock32.dll" nocase
        $c2 = "GetHostEntry"
	    $c3 = "getaddrinfo"
	    $c4 = "gethostbyname"
	    $c5 = "WSAAsyncGetHostByName"
	    $c6 = "DnsQuery"
    condition:
        1 of ($f*) and  1 of ($c*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 9 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/capabilities/capabilities.yar