SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
hunting-dns-tunneling-and-exfiltration
0
Detects DNS-based tunneling and data exfiltration in DNS logs: scoring high query volume to single domains, long/high-entropy subdomains, unusual record types, and encoded payload labels. Activates for requests to hunt DNS tunneling, detect DNS exfiltration, or analyze suspicious DNS query patterns.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Hunting DNS Tunneling and Exfiltration ## When to Use - You have DNS query logs (resolver, Zeek `dns.log`, Windows DNS) and want to find tunneling or exfiltration over DNS. - You are testing a hypothesis that an implant uses DNS as a covert channel. - You need to rank domains by tunneling indicators across many queries. **Do not use** query length alone as a verdict — CDNs, antivirus lookups, and some SaaS use long encoded labels legitimately; combine entropy, volume, and record-type signals. ## Prerequisites - DNS logs with query name, query type, source, and timestamp, over a meaningful window. - A way to whitelist known-benign high-volume domains (security vendors, CDNs). ## Workflow ### Step 1: Aggregate by registered domain Group queries under their registered/parent domain so per-domain volume and subdomain diversity are visible. ### Step 2: Score tunneling indicators Weight: high unique-subdomain count, long average label length, high subdomain entropy (encoded data), heavy `TXT`/`NULL`/`CNAME` usage, and high query rate to one domain. ```bash python scripts/analyst.py hunt dns.json ``` ### Step 3: Estimate exfiltration volume Sum encoded bytes implied by query lengths per domain; sustained high volume to a single nameserver suggests data egress. ### Step 4: Whitelist and pivot Remove known-benign high-entropy domains; for survivors, check domain age/registration, the authoritative nameserver, and the originating host. ### Step 5: Confirm and respond Validate by decoding sampled labels where possible and correlating with host activity; escalate confirmed tunnels and write a detection. ## Validation - High-score domains combine multiple signals (entropy + volume + record type), not one alone. - Benign high-volume domains are whitelisted, keeping the list reviewable. - Confirmed tunnels tie to a specific host and a young/suspicious domain. ## Pitfalls - Flagging long labels from CDNs and AV telemetry as tunneling. - Aggregating by full FQDN instead of registered domain, hiding subdomain diversity. - Ignoring record type; `TXT`/`NULL` carry far more data than `A` records. ## References - See [`references/api-reference.md`](references/api-reference.md) for the DNS hunt scorer. - ATT&CK T1071.004 and T1048 (linked in frontmatter).