DNS Tunneling Detection

Use case development / Prevent Data Exfiltration / Detect DNS Exfiltration

sigma

Detection rule

title: High Entropy DNS Queries
status: experimental
description: Detects DNS queries with unusually long or random-looking subdomains
logsource:
  product: dns
detection:
  selection:
    query_length: '>50'
  condition: selection | count() by src_ip > 100
  timeframe: 1h
falsepositives:
  - CDN traffic
  - Some legitimate services
level: medium
tags:
  - attack.exfiltration
  - attack.t1048

Test cases

• Generate DNS queries with encoded data

False positive guidance

Whitelist known CDN and legitimate long domain services.

Detection course