skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-exfiltration-over-dns-with-zeek

Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains and anomalous query patterns.

954|172|Updated Mar 13, 2026
Search Tags:#detection#network security#threat hunting#zeek#dns exfiltration#dns tunneling#entropy analysis
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-exfiltration-over-dns-with-zeek
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-exfiltration-over-dns-with-zeek
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-security/detecting-exfiltration-over-dns-with-zeek
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-exfiltration-over-dns-with-zeek

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

DNS tunneling lets attackers bypass firewalls and DLP controls by encoding stolen data into DNS query subdomains, and manual log review cannot reliably spot these patterns at scale. This Skill automates the analysis of Zeek dns.log files to surface exfiltration indicators before data leaves the network.

Core Features & Use Cases

  • Entropy and Label Analysis: Computes Shannon entropy per subdomain label and flags labels approaching the 63-character DNS limit, catching encoded payloads from tools like dnscat2, iodine, and dns2tcp.
  • Anomaly Scoring: Counts unique subdomains per parent domain, measures query volume per source IP, and combines signals into a composite risk score with a ranked JSON report.
  • Detection Gap Guidance: Documents blind spots such as DoH/DoT traffic, low-and-slow tunneling, word-list encoding, and answer-side exfiltration, with pivots to ssl.log and conn.log.
  • Use Case: A SOC analyst investigating a suspected compromise runs the parser over a day's dns.log and receives a JSON report flagging 'data.evil-c2.com' with 892 unique subdomains, average entropy of 4.72, and the originating internal IP for containment.

Quick Start

Analyze the attached Zeek dns.log file and report any domains showing DNS exfiltration indicators such as high-entropy subdomains or excessive unique subdomain counts.

Frequently Asked Questions about detecting-exfiltration-over-dns-with-zeek

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect DNS tunneling with Zeek logs?▼

Parse the dns.log #fields header to locate query and qtype_name columns, then compute Shannon entropy per subdomain label, flag labels over 52 characters, and count unique subdomains per parent domain. Domains exceeding thresholds like entropy above 4.0 or 50 unique subdomains are scored and reported as suspicious.

What entropy threshold indicates DNS exfiltration?▼

Legitimate subdomains typically have Shannon entropy below 3.5, while encoded or encrypted tunneling data produces entropy above 4.0. Combine entropy with label length and unique-subdomain counts, since word-list encoders can keep entropy artificially low.

Does Zeek dns.log capture DNS over HTTPS traffic?▼

No. DoH on port 443 and DoT on port 853 bypass Zeek's DNS analyzer, so no dns.log record is produced. Pivot to ssl.log for SNI of public resolvers from non-browser hosts and conn.log for port 853 connections instead.

Why does DNS exfiltration detection miss low-and-slow tunnels?▼

A tunnel pacing only a few queries per minute stays under per-window thresholds like 50 unique subdomains. Aggregate unique-subdomain counts per parent domain across hours or days and add a sustained-rate-per-source signal rather than relying on a single-window threshold.

How do I validate a DNS exfiltration detector works?▼

Generate a known tunnel in a lab using iodine or dnscat2 to a controlled domain, run the parser over the resulting dns.log, and confirm the domain appears in flagged_domains with high_entropy or long_labels indicators. Also verify #fields header parsing with zeek-cut to rule out column-offset bugs.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

analyzing-network-traffic-for-incidents

Detect adversary activity in PCAPs, Zeek logs, and IDS alerts.

Community
Advanced
WhaleylawWhaleylaw

security-incident-specialist

Investigate and contain security incidents in production systems.

Community
Advanced
msandbumsandbu
2

honeypot-investigation

Automates security analysis of honeypot servers by querying failed connections and enriching IPs with threat intelligence.

Community
Advanced
jcastillotxjcastillotx

Wireshark Network Traffic Analysis

Capture, filter, and inspect packets from live captures or PCAP files.

Community
Intermediate