| name | detecting-command-and-control-over-dns |
| description | Use when detecting command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. |
| domain | cybersecurity |
| tags | ["dns","c2","tunneling","dga","network-forensics","threat-detection"] |
| subdomain | network-security |
| version | 1.0.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"] |
Detecting Command And Control Over Dns
Overview
Cybersecurity skill for detecting command and control over dns. Follows industry best practices and security standards.
When to Use
Trigger phrases:
-
"detecting command and control over dns"
-
"Detects command-and-control (C2) communications tunneled through DNS protocol in"
-
Investigating suspected DNS tunneling used for C2 communication or data exfiltration
-
Analyzing DNS query logs for signs of encoded payloads in subdomain strings
-
Classifying domains as DGA-generated vs. legitimate using statistical or ML methods
-
Detecting DNS beaconing patterns (regular intervals, consistent query sizes)
-
Hunting for Iodine, dnscat2, dns2tcp, Cobalt Strike DNS, or Sliver DNS traffic
-
Monitoring TXT record abuse for command delivery or staged payload download
-
Building DNS anomaly detection rules for SOC/SIEM deployment
Do not use for general DNS performance monitoring or DNS configuration auditing; use DNS health monitoring tools for those. For HTTP/HTTPS-based C2 detection, use network traffic analysis skills focused on web protocols.
DISCLAIMER: DNS tunneling tools referenced in this skill (Iodine, dnscat2, dns2tcp) are dual-use. They have legitimate uses (bypassing captive portals, security research) and malicious uses (C2 channels, exfiltration). Only deploy detection in networks you are authorized to monitor. Testing tunneling tools requires explicit authorization.
When NOT to Use
- When you lack proper authorization for testing
- For production systems without change management
- When the task requires legal or compliance expertise beyond technical scope
Prerequisites
- DNS query logs from recursive resolver, Zeek/Bro, Suricata, or passive DNS tap
- Python 3.9+ with
numpy, scikit-learn, pandas, tldextract, and dnspython
- Zeek (formerly Bro) with dns.log output or Suricata with DNS EVE JSON logging
- SIEM access (Splunk, Elastic, Microsoft Sentinel) for log correlation
- Passive DNS database access (CIRCL pDNS, Farsight DNSDB, or internal) for enrichment
- Wireshark/tshark for packet-level DNS inspection
- Known-good domain whitelist (Alexa/Tranco top 1M or Majestic Million)
