performing-dns-tunneling-detection

name	performing-dns-tunneling-detection
description	Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality. Uses scapy for packet capture analysis and statistical methods to distinguish legitimate DNS from covert channels. Use when hunting for data exfiltration.
domain	cybersecurity
subdomain	security-operations
tags	["dns-tunneling","exfiltration-detection","shannon-entropy","dns-analysis","threat-detection","security-operations"]
version	1.0
author	mahipal
license