Potential DNS Tunneling via Scripting Engines

Mohamad Amin Bin A Hamid@aminhamid91

•updated Oct 21, 2025•21•0•466

This detection identifies network connections to external DNS servers over TCP (port 53) initiated by common scripting engines like PowerShell, Python, or WScript. While DNS over TCP is a valid protocol, it is less common for standard queries and is often used by malware for command and control (C2) or data exfiltration through DNS tunneling.