hunting-for-dns-tunneling-with-zeek

DNS tunneling detection in Zeek dns.log involves analyzing high-entropy subdomain queries, excessive query volumes, long query lengths, and unusual DNS record types to identify data exfiltration. The Skill produces risk scores and per-source mapping for SOC investigations.

Indicators of DNS tunneling include high-entropy subdomain queries, excessive query volumes per domain, long query lengths, and unusual DNS record types. Analyzing these signatures in Zeek dns.log reveals covert channels and data exfiltration activities.

DNS tunneling analysis supports threat hunting, incident response, and forensic investigations by generating structured findings with risk scores, indicators, and per-domain mapping. This guides SOC investigations across enterprise networks where Zeek dns.log is collected.

Run the analysis scripts against your Zeek dns.log to calculate entropy, analyze subdomains, and evaluate query lengths. The scripts apply configurable thresholds to generate a JSON report of DNS tunneling findings.

DNS tunneling analysis supports configurable thresholds for entropy calculations, subdomain analysis, and query length evaluation. This allows you to tailor detection sensitivity and reporting outputs to your specific network environment.

The DNS tunneling analysis generates a JSON report of structured findings. This output includes per-domain risk scores, actionable indicators, and per-source mapping to support SOC investigations and forensic analysis.