Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional netw

Analyzing DNS Logs for Exfiltration When to Use Use this skill when: SOC teams suspect data exfiltration through DNS tunneling to bypass firewall/proxy controls Threat intelligence indicates adversaries using DNS based C2 channels (e.g., Cobalt Strike DNS beacon) UEBA detects anomalous DNS query volumes from specific hosts Malware analysis reveals DNS over HTTPS (DoH) or DNS tunneling capabilities Do not use for standard DNS troubleshooting or availability monitoring — this skill focuses on security relevant DNS abuse detection. Prerequisites DNS query logging enabled (Windows DNS Server, Bind, Infoblox, or Cisco Umbrella) DNS logs ingested into SIEM (Splunk with Stream:DNS , dns sourcetype, or Zeek DNS logs) Passive DNS data for historical domain resolution analysis Baseline of normal DNS behavior (query volume, domain distribution, TXT record frequency) Python with math and collections libraries for entropy calculation Workflow Step 1: Detect DNS Tunneling via Subdomain Length Analysis DNS tunneling encodes data in subdomain labels, creating unusually long queries: Step 2: Detect High Entropy Domain Queries (DGA Detection) Domain Generation Algorithms produce random looking domains: Python based Shannon Entropy Calculation for DNS queries: Splunk implementation of entropy scoring: Step 3: Detect Anomalous DNS Query Volume Identify hosts generating abnormal DNS traffic: Detect TXT record abuse (common tunneling method): Step 4: Detect Known DNS Tunneling Tools Search for signatures of common DNS tunneling tools: Detect DNS over HTTPS (DoH) bypassing local DNS: Step 5: Correlate DNS Findings with Endpoint Data Cross reference suspicious DNS with process data: Step 6: Calculate Data Exfiltration Volume Estimate Estimate data volume encoded in DNS queries: Key Concepts Term Definition DNS Tunneling Technique encoding data within DNS queries/responses to exfiltrate data or establish C2 channels through DNS DGA Domain Generation Algorithm — malware technique generating pseudo random domain names for C2 resilience Shannon Entropy Mathematical measure of randomness in a string — high entropy ( 3.5) in domain names indicates DGA or tunneling TXT Record Abuse Using DNS TXT records (designed for text data) as a high bandwidth channel for data tunneling DNS over HTTPS (DoH) DNS queries encrypted over HTTPS (port 443), bypassing traditional DNS monitoring Passive DNS Historical record of DNS resolutions showing which IPs a domain resolved to over time Tools & Systems Splunk Stream : Network traffic capture add on providing parsed DNS query data for SIEM analysis Zeek (Bro) : Network security monitor generating detailed DNS transaction logs for analysis Cisco Umbrella (OpenDNS) : Cloud DNS security platform blocking malicious domains and logging query data Infoblox DNS Firewall : DNS layer security providing RPZ based blocking and detailed query logging Farsight DNSDB : Passive DNS database for historical domain resolution lookups and infrastructure mapping Common Scenarios Cobalt Strike DNS Beacon : Detect periodic TXT queries with encoded payloads to C2 domain Data Exfiltration : Large volumes of unique subdomain queries encoding stolen data in Base64/hex DGA Malware : Detect DNS queries to algorithmically generated domains (high entropy, no web content) DNS over HTTPS Bypass : Employee using DoH to bypass corporate DNS filtering and monitoring Slow Drip Exfiltration : Low volume DNS tunneling staying below threshold alerts (requires baseline comparison) Output Format

analyzing-dns-logs-for-exfiltration