What problem does it solve?
Security teams struggle to identify command-and-control traffic hidden inside DNS, where attackers tunnel data through encoded subdomains, TXT records, and DGA-generated domains that evade simple signature rules.
Core Features & Use Cases
- Entropy-Based Tunnel Detection: Computes Shannon entropy, subdomain length, and encoding ratios on DNS queries from Zeek, Suricata, or tshark to flag Iodine, dnscat2, dns2tcp, and Cobalt Strike DNS traffic.
- TXT Record Payload Analysis: Decodes base64 TXT record content to detect PE/ELF executables, PowerShell stagers, and staged payload delivery while whitelisting legitimate SPF/DKIM records.
- ML DGA Classification: Trains Random Forest or Gradient Boosting classifiers on character-level features (entropy, bigram deviation, digit ratios) to separate DGA domains from legitimate ones.
- Beaconing Detection: Analyzes inter-query timing intervals per source IP and base domain to surface low-and-slow periodic C2 check-ins.
- Use Case: A SOC analyst investigating suspicious DNS traffic can feed Zeek dns.log output into the entropy analysis workflow, flag high-entropy subdomains, then classify the associated domains with the DGA model to confirm tunneling.
Quick Start
Analyze my Zeek dns.log for DNS tunneling indicators and classify any suspicious domains as DGA or legitimate.
