Suspicious DNS Query with B64 Encoded String

Title: Suspicious DNS Query with B64 Encoded String
Status: test
Description:Detects suspicious DNS queries using base64 encoding
References:
  -https://github.com/krmaxwell/dns-exfiltration
Author: Florian Roth (Nextron Systems)
Date: 2018-05-10
modified:2022-10-09
Tags:

• -'attack.exfiltration'
• -'attack.t1048.003'
• -'attack.command-and-control'
• -'attack.t1071.004'

Logsource:

• category: dns

Detection:
  selection:
    query|contains: '==.'
  condition:selection
Falsepositives:
  -Unknown
Level: medium