# Statistical indicators of DNS tunneling
high_entropy_subdomain: >3.5 bits per character in subdomain labels
long_query_names: >50 characters total FQDN length
deep_subdomains: >4 label levels (a.b.c.d.evil.com)
high_txt_volume: Abnormal TXT record query/response ratio
single_domain_volume: >100 queries/min to single domain
non_standard_types: NULL, PRIVATE, or TXT heavy query mix

# Detect long DNS queries (possible tunneling)
alert dns $HOME_NET any -> any any ( \
  msg:"DNS Tunnel - excessively long query name"; \
  dns.query; content:"."; offset:50; \
  threshold:type both, track by_src, count 10, seconds 60; \
  classtype:bad-unknown; \
  sid:3001001; rev:1; \
  metadata:mitre_attack_technique T1071.004;)

# Detect high volume TXT queries to single domain
alert dns $HOME_NET any -> any any ( \
  msg:"DNS Tunnel - high volume TXT queries"; \
  dns.query; content:"."; \
  dns.opcode:0; \
  threshold:type both, track by_src, count 50, seconds 300; \
  classtype:bad-unknown; \
  sid:3001002; rev:1;)

# Detect known DNS tunnel tool signatures
alert dns $HOME_NET any -> any any ( \
  msg:"DNS Tunnel - iodine handshake detected"; \
  dns.query; content:"."; \
  content:"v"; offset:0; depth:1; \
  pcre:"/^v[0-9a-f]{4}\./"; \
  sid:3001003; rev:1;)

# dns-tunnel-detect.zeek — entropy-based DNS tunnel detection
@load base/protocols/dns

module DNSTunnel;

export {
    redef enum Notice::Type += {
        DNS_Tunnel_Suspected,
        DNS_Tunnel_High_Volume,
    };

    const entropy_threshold = 3.5 &redef;
    const query_len_threshold = 52 &redef;
}

function calc_entropy(s: string): double {
    local freq: table[string] of count = {};
    local n = |s|;
    for ( i in s ) {
        if ( s[i] !in freq )
            freq[s[i]] = 0;
        ++freq[s[i]];
    }
    local ent = 0.0;
    for ( c, cnt in freq ) {
        local p = cnt * 1.0 / n;
        ent -= p * log2(p);
    }
    return ent;
}

event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) {
    if ( |query| > query_len_threshold ) {
        local ent = calc_entropy(query);
        if ( ent > entropy_threshold ) {
            NOTICE([$note=DNS_Tunnel_Suspected,
                    $msg=fmt("High entropy DNS query: %s (entropy=%.2f)", query, ent),
                    $conn=c,
                    $identifier=cat(c$id$orig_h, query)]);
        }
    }
}

# Extract DNS queries from Zeek logs and compute statistics
zeek-cut query < dns.log | awk '{print length, $0}' | sort -rn | head -20

# Find domains with highest query volume
zeek-cut query < dns.log | rev | cut -d. -f1-2 | rev | sort | uniq -c | sort -rn | head -20

# Identify TXT record abuse
zeek-cut qtype_name query < dns.log | grep "TXT" | cut -f2 | sort | uniq -c | sort -rn

# Capture DNS traffic for offline analysis
tcpdump -i eth0 -w dns_capture.pcap 'port 53'
suricata -r dns_capture.pcap -S /etc/suricata/rules/dns-tunnel.rules -l /tmp/dns_test/

# Check Suricata alerts for DNS tunnel signatures
cat /var/log/suricata/eve.json | \
  jq 'select(.event_type=="alert" and .alert.signature | contains("DNS Tunnel"))'

# Review Zeek notices
cat notice.log | zeek-cut note msg

# Test with iodine (lab only)
iodine -f -r 10.0.0.53 tunnel.lab.local

# Test with dnscat2
dnscat2 --dns server=10.0.0.53,domain=tunnel.lab.local

title: Dns Tunneling Detection
id: 27bfd9b7-a2a5-4337-86dd-59a521d14642
status: experimental
description: Detects suspicious activity related to detecting dns tunneling techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1071.004
  - attack.t1048.003
  - attack.t1572
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks