performing-dns-tunneling-detection

name	performing-dns-tunneling-detection
description	Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality. Uses scapy for packet capture analysis and statistical methods to distinguish legitimate DNS from covert channels. Use when hunting for data exfiltration.
domain	cybersecurity
tags	["performing","dns","tunneling","detection"]
subdomain	security-operations
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02"]

Performing Dns Tunneling Detection

Overview

Cybersecurity skill for performing dns tunneling detection. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing dns tunneling detection"

• "When conducting security assessments that involve performing dns tunneling detec"

• "When following incident response procedures for related security events"

• "When performing scheduled security testing or auditing activities"

• When conducting security assessments that involve performing dns tunneling detection

• When following incident response procedures for related security events

• When performing scheduled security testing or auditing activities

• When validating security controls through hands-on testing

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Familiarity with security operations concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Plan Operations — Define objectives, scope, and success criteria for dns tunneling detection operations.