detecting-exfiltration-over-dns-with-zeek

name	detecting-exfiltration-over-dns-with-zeek
description	Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains and anomalous query patterns
domain	cybersecurity
subdomain	network-security
tags	["dns-exfiltration","zeek","entropy-analysis","threat-hunting"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]

Detecting Exfiltration over DNS with Zeek

Overview

DNS tunneling and exfiltration is a technique used by attackers to bypass firewalls and DLP controls by encoding stolen data into DNS query subdomains. Legitimate DNS queries have predictable entropy and length patterns, while exfiltration queries contain encoded data with high Shannon entropy, unusually long subdomain labels, and high volumes of unique subdomains per parent domain.

This skill analyzes Zeek dns.log files (TSV format) to detect exfiltration indicators. The agent computes Shannon entropy for each subdomain component, identifies queries exceeding the 63-character DNS label limit, counts unique subdomains per parent domain, and flags domains that exceed configurable thresholds. These techniques detect tools like dnscat2, iodine, dns2tcp, and custom DNS tunneling implementations.

When to Use

• When investigating security incidents that require detecting exfiltration over dns with zeek
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Detection Gaps & Validation

• DoH/DoT never lands in dns.log: if the host tunnels over https:// (443) or DoT (853), Zeek's DNS analyzer produces no record to score. Pivot to ssl.log SNI of public resolvers from non-browser hosts and conn.log 853, and treat absence of dns.log for a chatty host as suspicious, not clean.
• Low-and-slow defeats per-window counts: a tunnel pacing a few queries/min stays under "50 unique subdomains within the log window." Aggregate unique-subdomain counts per parent domain across hours/days, and add a sustained-rate-per-source signal, not just a single-window threshold.
• Word-list encoding lowers entropy: dictionary-based encoders (and lowercase chunking) keep label entropy under 3.5/4.0. Combine entropy with label-length, label-count, and unique-subdomain ratio so a low-entropy-but-high-cardinality domain still scores.
• Answer-side data is missed: exfil via large TXT/NULL/CNAME answers won't show in QNAME analysis. Parse qtype_name and answers for TXT/NULL/CNAME abuse and oversized responses.
• Validate the detector fires: generate a known tunnel in a lab (iodine, dnscat2 --dns) to a controlled domain, run the parser over the resulting dns.log, and confirm the domain appears in flagged_domains with /. Verify header parsing by — a column-offset bug silently zeroes results.