DNS tunneling
A DNS query whose name carries a very long, high-entropy label — the shape of DNS tunneling / DGA, where data or C2 traffic is smuggled inside DNS…
What it detects
A DNS query whose name carries a very long, high-entropy label — the shape of DNS tunneling / DGA, where data or C2 traffic is smuggled inside DNS subdomains that no human would type. Encodes exfiltration and command-and-control over a protocol that is almost always allowed outbound.
MITRE ATT&CK mapping
False positives and triage
Some CDNs, security products, and cloud services use long encoded hostnames legitimately. The signal is a HIGH VOLUME of long-label queries to one parent domain, queries to a newly-seen domain, or long TXT/NULL lookups. Correlate with the querying host and the parent domain's reputation.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/network/dns_tunneling.yaml, licensed under the Apache License 2.0.
id: network.c2.dns_tunneling
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [windows, linux, macos, network]
mitre_techniques: [T1071.004, T1048.003]
description: |
A DNS query whose name carries a very long, high-entropy label — the shape of DNS
tunneling / DGA, where data or C2 traffic is smuggled inside DNS subdomains that
no human would type. Encodes exfiltration and command-and-control over a protocol
that is almost always allowed outbound.
match:
event_action: dns_query
raw_message_regex: "QueryName:[^\\n]*[A-Za-z0-9+/=_-]{30,}"
correlation_keys: [hostname]
false_positive_guidance: |
Some CDNs, security products, and cloud services use long encoded hostnames
legitimately. The signal is a HIGH VOLUME of long-label queries to one parent
domain, queries to a newly-seen domain, or long TXT/NULL lookups. Correlate with
the querying host and the parent domain's reputation.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.