Introduction Adversaries are continuously developing techniques to reduce the detection rate of their malicious activities on an enterprise network; for example, they utilize stenography for data exfiltration, malicious software delivery, and covert C2 communications. This article provides an overview on detecting and hunting suspicious DNS connections in an enterprise network. Requirements In order to be… Continue reading →