Find signs of hidden data theft in DNS logs.
What it does
Identifies suspected DNS tunneling, malware-generated domains, and covert command channels in DNS logs and estimates potential data loss.
When to use it
Use when security teams suspect DNS exfiltration or command channels, observe anomalous DNS volumes, or find malware with DNS-tunneling capabilities.
How to use it
Give it DNS logs and supporting security data; it returns findings about suspected exfiltration, affected hosts, process attribution, and estimated data volume.
What you provide
- Your files
Uses
What you need · 3
Requires enabled DNS query logging, with Windows DNS Server, Bind, Infoblox, or Cisco Umbrella listed as sources.
Requires DNS logs ingested into a SIEM; the supplied workflow uses Splunk searches against DNS and supporting security indexes.
Requires Python with math and collections for entropy calculation.
Access · 1
This skill
Splunk
Reads security logs in Splunk