Hunting DNS Tunneling and Exfiltration

When to Use

• You have DNS query logs (resolver, Zeek dns.log, Windows DNS) and want to find tunneling or exfiltration over DNS.
• You are testing a hypothesis that an implant uses DNS as a covert channel.
• You need to rank domains by tunneling indicators across many queries.

Do not use query length alone as a verdict — CDNs, antivirus lookups, and some SaaS use long encoded labels legitimately; combine entropy, volume, and record-type signals.

Prerequisites

• DNS logs with query name, query type, source, and timestamp, over a meaningful window.
• A way to whitelist known-benign high-volume domains (security vendors, CDNs).

Workflow

Step 1: Aggregate by registered domain

Group queries under their registered/parent domain so per-domain volume and subdomain diversity are visible.

Step 2: Score tunneling indicators

Weight: high unique-subdomain count, long average label length, high subdomain entropy (encoded data), heavy TXT/NULL/CNAME usage, and high query rate to one domain.

python scripts/analyst.py hunt dns.json

Step 3: Estimate exfiltration volume

Sum encoded bytes implied by query lengths per domain; sustained high volume to a single nameserver suggests data egress.

Step 4: Whitelist and pivot

Remove known-benign high-entropy domains; for survivors, check domain age/registration, the authoritative nameserver, and the originating host.

Step 5: Confirm and respond

Validate by decoding sampled labels where possible and correlating with host activity; escalate confirmed tunnels and write a detection.

Validation

• High-score domains combine multiple signals (entropy + volume + record type), not one alone.
• Benign high-volume domains are whitelisted, keeping the list reviewable.
• Confirmed tunnels tie to a specific host and a young/suspicious domain.

Pitfalls

• Flagging long labels from CDNs and AV telemetry as tunneling.
• Aggregating by full FQDN instead of registered domain, hiding subdomain diversity.
• Ignoring record type; TXT/NULL carry far more data than A records.

References

• See references/api-reference.md for the DNS hunt scorer.
• ATT&CK T1071.004 and T1048 (linked in frontmatter).