agentsclimarketplace
Sign in

Hunting dns tunneling and exfiltration

Skill meltedinhex/analyst-ai-pack/skills/hunting-dns-tunneling-and-exfiltration

Detects DNS-based tunneling and data exfiltration in DNS logs: scoring high query volume to single domains, long/high-entropy subdomains, unusual record types, and encoded payload labels. Activates for requests to hunt DNS tunneling, detect DNS exfiltration, or analyze suspicious DNS query patterns.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-dns-tunneling-and-exfiltration

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.1 KB, 531 tokens by cl100k_base, as published. Nobody here has run it

Hunting DNS Tunneling and Exfiltration

When to Use

  • You have DNS query logs (resolver, Zeek dns.log, Windows DNS) and want to find tunneling or exfiltration over DNS.
  • You are testing a hypothesis that an implant uses DNS as a covert channel.
  • You need to rank domains by tunneling indicators across many queries.

Do not use query length alone as a verdict — CDNs, antivirus lookups, and some SaaS use long encoded labels legitimately; combine entropy, volume, and record-type signals.

Prerequisites

  • DNS logs with query name, query type, source, and timestamp, over a meaningful window.
  • A way to whitelist known-benign high-volume domains (security vendors, CDNs).

Workflow

Step 1: Aggregate by registered domain

Group queries under their registered/parent domain so per-domain volume and subdomain diversity are visible.

Step 2: Score tunneling indicators

Weight: high unique-subdomain count, long average label length, high subdomain entropy (encoded data), heavy TXT/NULL/CNAME usage, and high query rate to one domain.

python scripts/analyst.py hunt dns.json

Step 3: Estimate exfiltration volume

Sum encoded bytes implied by query lengths per domain; sustained high volume to a single nameserver suggests data egress.

Step 4: Whitelist and pivot

Remove known-benign high-entropy domains; for survivors, check domain age/registration, the authoritative nameserver, and the originating host.

Step 5: Confirm and respond

Validate by decoding sampled labels where possible and correlating with host activity; escalate confirmed tunnels and write a detection.

Validation

  • High-score domains combine multiple signals (entropy + volume + record type), not one alone.
  • Benign high-volume domains are whitelisted, keeping the list reviewable.
  • Confirmed tunnels tie to a specific host and a young/suspicious domain.

Pitfalls

  • Flagging long labels from CDNs and AV telemetry as tunneling.
  • Aggregating by full FQDN instead of registered domain, hiding subdomain diversity.
  • Ignoring record type; TXT/NULL carry far more data than A records.

References

What ships with it: 3 files

4.9 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.