Skills
.Work. You
Rest

hunt-dns-tunnel

Official

Detect DNS tunneling in Suricata logs.

Data & Analytics#log-analysis#threat-hunting#suricata#dns-tunneling#eve.json#payload-decoding
AuthorStamusNetworks
Version1.0.0
Installs0

System Documentation

What problem does it solve?

Detects and decodes DNS tunneling activity in Suricata eve.json, enabling analysts to identify covert data exfiltration and C2 channels.

Core Features & Use Cases

  • Detects two archetypes: TXT-based exfiltration with sequential chunks and dnscat2-style C2 using hex-encoded QNAME labels.
  • Reconstructs and decodes exfiltrated payloads or extracts raw session bytes.
  • Produces a structured events report with full dns.rrname and dns.rdata fields for thorough review, and can output decoded payloads to a file.

Quick Start

Run the hunt against eve.json to generate a detailed DNS tunneling report.

Dependency Matrix

Required Modules

None required

Components

Standard package

💻 Claude Code Installation

Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.

Please help me install this Skill:
Name: hunt-dns-tunnel
Download link: https://github.com/StamusNetworks/stamus-ai-tools/archive/main.zip#hunt-dns-tunnel

Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
View Source Repository

Agent Skills Search Helper

Install a tiny helper to your Agent, search and equip skill from 471,000+ vetted skills library on demand.