analyzing-dns-logs-for-exfiltration

name	analyzing-dns-logs-for-exfiltration
description	Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.
domain	cybersecurity
tags	["soc","dns","exfiltration","dns-tunneling","dga","c2-detection","splunk","threat-detection"]
subdomain	soc-operations
version	1.0
author	oyi77
license	Apache-2.0
atlas_techniques	["AML.T0024","AML.T0056","AML.T0086"]
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Analyzing Dns Logs For Exfiltration

Overview

Cybersecurity skill for analyzing dns logs for exfiltration. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "analyzing dns logs for exfiltration"
• "SOC teams suspect data exfiltration through DNS tunneling to bypass firewall/pro"
• "Threat intelligence indicates adversaries using DNS-based C2 channels (e"
• "UEBA detects anomalous DNS query volumes from specific hosts"

Use this skill when:

• SOC teams suspect data exfiltration through DNS tunneling to bypass firewall/proxy controls
• Threat intelligence indicates adversaries using DNS-based C2 channels (e.g., Cobalt Strike DNS beacon)
• UEBA detects anomalous DNS query volumes from specific hosts
• Malware analysis reveals DNS-over-HTTPS (DoH) or DNS tunneling capabilities

Do not use for standard DNS troubleshooting or availability monitoring — this skill focuses on security-relevant DNS abuse detection.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• DNS query logging enabled (Windows DNS Server, Bind, Infoblox, or Cisco Umbrella)
• DNS logs ingested into SIEM (Splunk with Stream:DNS, dns sourcetype, or Zeek DNS logs)
• Passive DNS data for historical domain resolution analysis
• Baseline of normal DNS behavior (query volume, domain distribution, TXT record frequency)
• Python with math and collections libraries for entropy calculation

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs() -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}