skills.rest
StamusNetworks
StamusNetworksOFFICIAL
Explore all skills by this author →
Website𝕏@StamusNGitHub

hunt-dns-tunnel

Detects and decodes TXT-based exfiltration and dnscat2-style DNS tunneling in Suricata eve.json files.

2|Updated Feb 27, 2026
Search Tags:#log-analysis#threat-hunting#suricata#dns-tunneling#eve.json#payload-decoding
One-click install
npx skills add https://github.com/StamusNetworks/stamus-ai-tools --skill hunt-dns-tunnel
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-dns-tunnel
Source: https://github.com/StamusNetworks/stamus-ai-tools/tree/main/plugins/suricata-analyze/skills/hunt-dns-tunnel
Command: npx skills add https://github.com/StamusNetworks/stamus-ai-tools --skill hunt-dns-tunnel

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects and decodes DNS tunneling activity in Suricata eve.json, enabling analysts to identify covert data exfiltration and C2 channels.

Core Features & Use Cases

  • Detects two archetypes: TXT-based exfiltration with sequential chunks and dnscat2-style C2 using hex-encoded QNAME labels.
  • Reconstructs and decodes exfiltrated payloads or extracts raw session bytes.
  • Produces a structured events report with full dns.rrname and dns.rdata fields for thorough review, and can output decoded payloads to a file.

Quick Start

Run the hunt against eve.json to generate a detailed DNS tunneling report.

Frequently Asked Questions about hunt-dns-tunnel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect DNS tunneling in Suricata eve.json logs?▼

DNS tunneling in Suricata eve.json logs is detected by analyzing DNS queries and responses to identify TXT-based exfiltration and dnscat2-style C2 channels, reconstructing payloads and outputting a structured threat hunting report.

What types of DNS exfiltration patterns can threat hunting identify in network traffic?▼

Threat hunting can identify two main DNS tunneling archetypes: TXT-based exfiltration using sequential data chunks and dnscat2-style command and control channels utilizing hex-encoded QNAME labels.

Can I decode exfiltrated payloads found in DNS tunneling traffic?▼

Yes, you can decode payloads from DNS tunneling traffic by reconstructing session bytes from captured DNS events, with options to output the decoded exfiltrated data directly to a file for review.

How do I extract dnscat2 C2 session data from DNS logs?▼

Extract dnscat2 C2 session data from DNS logs by scanning for hex-encoded QNAME labels, reconstructing the raw session bytes, and surfacing detailed events with full dns.rrname and dns.rdata fields.

Does DNS tunneling detection require Suricata alerts to be triggered first?▼

No, DNS tunneling detection does not require pre-triggered Suricata alerts; it directly scans and analyzes eve.json logs to independently reconstruct payloads and surface covert traffic patterns.

What details are included in a DNS tunneling threat hunting report?▼

A DNS tunneling threat hunting report includes a structured events table with per-event details, highlighting affected hosts, traffic patterns, full dns.rrname and dns.rdata fields, and decoded payload outputs.

Related Skills

Explore More Data & Analytics Skills→
GeneralReasoningGeneralReasoning
4

suricata-offline-evejson

Analyzes PCAP traffic offline with Suricata and validates detections via eve.json.

Official
Intermediate
UnitOneAIUnitOneAI
44

containment

Generate NIST SP 800-61 Rev 2-aligned containment plans with MITRE ATT&CK-mapped countermeasures.

Official
Intermediate
jg-chalk-iojg-chalk-io

moai-security-threat

Model enterprise systems with STRIDE and generate Snort, Suricata, and ModSecurity rules.

Community
Advanced
YukiIto1999YukiIto1999

hunting-for-command-and-control-beaconing

Detect command-and-control beaconing patterns in Zeek-derived network logs.

Community
Advanced