Detection of DNS Requests to AI-Related Domains
This query identifies DNS requests to domains listed in the AI-Domains.csv lookup. It filters out browser-initiated traffic from Chrome and Edge. The result highlights which hosts and processes are generating the most DNS requests to those domains.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=DnsRequest event_platform=Win
| match(file="generative-ai-domains.csv", field=[DomainName],column=domain,ignoreCase=true,mode=glob)
| !in(field=ContextBaseFileName, values=[msedge.exe,chrome.exe],ignoreCase=true)
| SourceProcess := ContextBaseFileName
| groupBy([DomainName, ComputerName,SourceProcess],function=count(as=Count))
| sort(field=Count,type=number,order=desc)The query relies on an lookup file with at least one column named Domain. The lookup provides the set of AI-related domains to check against. Without this file, the match() operator cannot resolve which DNS requests should be considered relevant.
Example
| Domain |
|---|
| chat.openai.com |
| chatgpt.com |
| openai.com |
| claude.ai |
| anthropic.com |
| bard.google.com |
| *.ai |
| *.openai.com |
detection_of_dns_requests_to_ai_related_domains.yml
ByteRay
Hunting
Endpoint
Insight
2025-12-10
2026-03-18
