They should - high entropy dns names and frequent subdomains should be indicators to watch for. The bad news is they can be noisy and not get the attention they

They should - high entropy dns names and frequent subdomains should be indicators to watch for. The bad news is they can be noisy and not get the attention they deserve (never saw a SOC that wasn't swimming in alerts).