通过分析 Zeek 的 dns.log，检测 DNS 隧道与隐蔽信道数据外传，重点关注高熵子域查询、异常查询量、过长查询长度以及非常规 DNS 记录类型（TXT/NULL/CNAME）。适用于在网络流量中搜寻基于 DNS 的数据外传或 C2 隐蔽信道，或对 Zeek 日志暴露出的可疑 DNS 查询量与查询模式进行研判的场景。
When hunting for data exfiltration over DNS covert channels
After threat intelligence indicates DNS-based C2 frameworks targeting your industry
When dns.log shows unusually high query volumes to specific domains
During investigation of suspected data theft where no HTTP/S exfiltration is found
When monitoring for tools like iodine, dnscat2, DNSExfiltrator, or DNS-over-HTTPS tunneling
Prerequisites
Zeek deployed on network tap or SPAN port capturing DNS traffic
Zeek dns.log with full query and response fields
SIEM platform for dns.log analysis (Splunk, Elastic)
RITA (Real Intelligence Threat Analytics) for automated DNS analysis
Passive DNS data for historical domain resolution context
Workflow
Analyze Query Length Distribution: DNS tunneling encodes data in subdomain labels, producing queries significantly longer than normal. Normal DNS queries average 20-30 characters; tunneling queries often exceed 50+ characters. Calculate mean and standard deviation of query lengths per domain.
Calculate Subdomain Entropy: Tunneling encodes data using Base32/Base64, producing high-entropy subdomai…
