hunting-for-dns-tunneling-with-zeek

What problem does it solve?

DNS-based covert channels and data exfiltration can go undetected in routine network monitoring. This Skill detects such activity by analyzing Zeek dns.log for signatures like high-entropy subdomain queries, excessive query volumes, long query lengths, and unusual DNS record types.

Core Features & Use Cases

• Analyze Zeek dns.log to identify high-entropy subdomain queries, long query lengths, excessive query volumes per domain, and unusual DNS record types.
• Produce structured findings including risk scores, indicators, and per-source/domain mapping to support SOC investigations.
• Use cases include threat hunting, incident response, and forensic investigations in enterprise networks.

Quick Start

Run the agent against your Zeek dns.log to generate a JSON report of DNS tunneling findings.