domains / families / security / analyzing-dns-logs-for-exfiltration

analyzing-dns-logs-for-exfiltration

separate

'Analyzes DNS query logs to detect data exfiltration via DNS tunneling,

When to use

• SOC teams suspect data exfiltration through DNS tunneling to bypass firewall/proxy controls
• Threat intelligence indicates adversaries using DNS-based C2 channels (e.g., Cobalt Strike DNS beacon)
• UEBA detects anomalous DNS query volumes from specific hosts
• Malware analysis reveals DNS-over-HTTPS (DoH) or DNS tunneling capabilities

When not to use

• standard DNS troubleshooting
• availability monitoring

Skill page

Source