Skip to content
Threat Feed
Subscribe

Tag

Dns-Monitoring

2 briefs RSS
medium advisory

Detection of Internal Host Connections to Dynamic DNS Providers

This detection identifies DNS queries from internal hosts to known dynamic domain providers, a technique frequently used by attackers to maintain flexible command-and-control infrastructure and host malicious payloads.

command-and-control dns-monitoring network-security dynamic-dns threat-hunting
1r 1t
medium advisory

Detection of Local LLM Framework DNS Queries

This brief details the detection of DNS queries originating from local Large Language Model (LLM) frameworks like Ollama, LM Studio, and GPT4All on Windows endpoints, leveraging Sysmon Event ID 22 to identify potential unauthorized AI tool usage or data exfiltration risks associated with model downloads, updates, and telemetry from repositories such as huggingface.co and ollama.ai.

Claude +16 local-llm shadow-ai dns-monitoring data-exfiltration policy-violation windows endpoint-security
1r 3t 18i