domains / families / security / hunting-for-dns-tunneling-with-zeek

hunting-for-dns-tunneling-with-zeek

separate

Detects DNS tunneling and covert-channel data exfiltration by analyzing

When to use

• When hunting for data exfiltration over DNS covert channels
• After threat intelligence indicates DNS-based C2 frameworks targeting your industry
• When dns.log shows unusually high query volumes to specific domains
• During investigation of suspected data theft where no HTTP/S exfiltration is found
• When monitoring for tools like iodine, dnscat2, DNSExfiltrator, or DNS-over-HTTPS tunneling

Skill page

Source