For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/default_rules/def-000-l2t.md. A documentation index is available at /llms.txt.

DNS activity observed associated with a malicious domain identified by Datadog Security Research

This rule is part of a beta feature. To learn more, contact Support.

Classification:

threat-intel

Tactic:

TA0011-command-and-control

Technique:

T1566-phishing

Goal

Detects DNS queries in OCSF DNS activity events where the queried domain matches Datadog Security Research threat intelligence as malicious or suspicious.

Strategy

This rule monitors OCSF DNS activity where class_uid is 4003, with threat enrichment where @threat_intel.results.source.name is Datadog Security Research, @threat_intel.results.intention is malicious or suspicious, and @threat_intel.indicators_matched is Domain.

Triage & Response

  • Examine {{@ocsf.query.hostname}} and {{@ocsf.src_endpoint.ip}} against normal baselines for the subnet, resolver, or application path that issued the query.
  • Review {{@ocsf.rcode_id}} and related answer fields on the event to see whether the name resolved and the data returned.
  • Identify the asset or service behind {{@ocsf.src_endpoint.ip}} or {{@ocsf.src_endpoint.hostname}} when that hostname is populated.
  • Check adjacent DNS and network activity from the same source around the alert window for unusual volume or related domains.
  • Determine whether the query aligns with known software updates, security tooling, or sanctioned third-party services rather than unexpected client behavior.