skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-dns-exfiltration-with-dns-query-analysis

Detect DNS tunneling and data exfiltration by analyzing query entropy, subdomain length, and TXT record abuse.

954|172|Updated Mar 13, 2026
Search Tags:#threat detection#siem#suricata#zeek#dns exfiltration#dns tunneling#entropy analysis
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-dns-exfiltration-with-dns-query-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-dns-exfiltration-with-dns-query-analysis
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-security/detecting-dns-exfiltration-with-dns-query-analysis
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-dns-exfiltration-with-dns-query-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pandas, scipy, numpy, scikit-learn.

What problem does it solve?

Attackers exfiltrate data through DNS queries and responses because DNS traffic is rarely inspected, and traditional volume-based alerts miss low-and-slow or encoded tunneling. This Skill gives SOC analysts a structured method to detect DNS exfiltration using passive DNS logs, statistical analysis, and SIEM rules.

Core Features & Use Cases

  • Statistical Query Analysis: A Python detector scores domains on subdomain length, Shannon entropy, unique-subdomain ratio, and TXT/NULL query ratios using Zeek or Suricata logs.
  • Network Detection Rules: Ready-to-deploy Suricata rules (SIDs 3000001-3000005) catch long queries, high-entropy subdomains, oversized TXT responses, and iodine/dnscat2 indicators.
  • SIEM Integration: A Splunk SPL query aggregates query counts, unique subdomains, and average label lengths to assign risk scores per domain.
  • Use Case: After an incident, replay a suspect PCAP through Zeek, run the Python detector against dns.log, and confirm whether a domain scores above the exfiltration threshold before blocking it and isolating the source host.

Quick Start

Analyze the Zeek dns.log from our sensor for DNS exfiltration indicators and list any suspicious domains with their scores.

Frequently Asked Questions about detecting-dns-exfiltration-with-dns-query-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect DNS tunneling and exfiltration in network logs?▼

Analyze DNS query logs for long subdomains (over 30 characters), high Shannon entropy (above 3.8 bits), high unique-subdomain ratios, and heavy TXT or NULL query usage. The included Python detector processes Zeek dns.log or Suricata EVE JSON and scores each domain against these thresholds.

What tools detect DNS exfiltration like iodine or dnscat2?▼

Zeek and Suricata capture DNS traffic, while Suricata rules SIDs 3000001-3000005 flag long queries, high-entropy subdomains, large TXT responses, and NULL record queries typical of iodine. A Python scoring script and Splunk SPL query provide statistical detection across aggregated logs.

Does DNS query analysis work with encrypted DNS like DoH or DoT?▼

No. DNS over HTTPS (port 443) and DNS over TLS (port 853) bypass port-53 capture, so entropy and length checks see nothing. Force all resolution through internal resolvers, block outbound 53/853 and known DoH IPs, and alert on direct-to-public-resolver traffic via TLS SNI inspection.

Why does DNS exfiltration detection miss low-and-slow attacks?▼

Attackers pacing a few queries per minute stay under volume thresholds like 50 queries minimum. Lower volume gates for sensitive hosts, add a per-day unique-subdomain count per base domain, and sum total bytes in QNAMEs over time instead of scoring single queries.

How do I reduce false positives in DNS tunneling alerts?▼

Whitelist legitimate high-volume or long-label domains such as CDN endpoints like *.cloudfront.net, AV/EDR telemetry, and DNS-based load balancers. Exclude SPF, DKIM, and DMARC TXT records before alerting, and validate rules by replaying a known iodine or dnscat2 PCAP.

Related Skills

Explore More Software Engineering Skills→
GhostPWNGhostPWN
4

Network Security & Traffic Analysis

Analyze PCAP files and firewall configurations to generate Suricata, Snort, and Zeek detection rules.

Official
Advanced
StamusNetworksStamusNetworks
2

hunt-dns-tunnel

Detects and decodes TXT-based exfiltration and dnscat2-style DNS tunneling in Suricata eve.json files.

Official
Advanced
NCLGISANCLGISA

nextdns-api

Manage NextDNS protective DNS profiles via the REST API.

Official
Intermediate
youyinnnyouyinnn
1

aeon

Provide a unified Python toolkit for time series machine learning tasks.

Community
Advanced