skills.rest
chenchunrun
chenchunrunCOMMUNITY
Explore all skills by this author →
GitHub

dns-cache-detection

Detect DNS cache threats via TTL-based cache snooping and RD=0 probing.

1|1|Updated Apr 25, 2026
Search Tags:#dns#ttl#threat-detection#ioc#c2#rd0
One-click install
npx skills add https://github.com/chenchunrun/onyx-soc --skill dns-cache-detection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dns-cache-detection
Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/dns-cache-detection
Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill dns-cache-detection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires dnspython, pyyaml, requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Detect DNS cache threats inside enterprise networks by analyzing TTL differences and RD=0 probing to identify cached-domain hits linked to potential C2 activity.

Core Features & Use Cases

  • Lightweight, no log access required threat detection on internal DNS servers.
  • Detects potential C2 beaconing and malicious domain access through TTL-based cache snooping.
  • Real-world use: continuous monitoring of corporate DNS to surface suspicious domain activity and trigger alerts.

Quick Start

Run the V2 quick-detection pipeline against your enterprise DNS using the provided config_soe.yaml.

Frequently Asked Questions about dns-cache-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How does DNS cache snooping detect C2 activity using TTL analysis?▼

No, this threat detection requires no log access. It identifies potential C2 activity by directly probing enterprise DNS environments with RD=0 queries and analyzing TTL-based cache snooping data.

How do I monitor enterprise DNS servers for malicious domain access without logs?▼

No, this threat detection requires no log access. It identifies potential C2 activity by directly probing enterprise DNS environments with RD=0 queries and analyzing TTL-based cache snooping data.

Can I trigger automated alerts for suspicious DNS activity to DingTalk?▼

Yes, the pipeline supports automated threat verification and DingTalk alerts. It triggers rapid response notifications when suspicious domain access patterns are detected in enterprise DNS environments.

Do I need dnspython and PyYAML to run TTL-based cache snooping?▼

Yes, you need dnspython, PyYAML, and requests installed. These dependencies enable the RD=0 probing, configuration parsing via YAML files, and automated threat verification API calls.

What is the best way to start continuous DNS threat detection on corporate networks?▼

Run the quick-detection pipeline against your enterprise DNS using the provided config_soe.yaml file. This executes TTL analysis and RD=0 probing to surface suspicious domain activity immediately.

Related Skills

Explore More Data & Analytics Skills→
guia-matthieuguia-matthieu
145

deliverability-checker

Audit DNS records for SPF, DKIM, DMARC, and MX configurations.

Community
Basic
FuzzdkkFuzzdkk
3

network-forensics

Analyze PCAP/PCAPNG captures to detect C2 beacons and DNS tunneling.

Community
Advanced
Steffen025Steffen025
186

SECUpdates

Aggregate security news into a ranked digest with categories and source attribution.

Community
Advanced
macaughmacaugh
5

Automated Subdomain Enumeration

Enumerate subdomains via passive sources and active DNS techniques.

Community
Advanced