DNS Tunneling via OAST Domains with Long Subdomains
Detects DNS queries to known OAST (Out-of-Band Application Security Testing) domains like oastify.com, oast.pro, and oast.fun where the subdomain is unusually long (over 50 characters). Long subdomains may indicate encoded data exfiltration, a technique observed in the exploitation of vulnerabilities like CVE-2026-1731 to bypass egress filtering.
Microsoft Sentinel (KQL)
