High Volume DNS Queries with Long Subdomains (DNS Tunneling)
This rule detects potential DNS tunneling or data exfiltration by identifying high volumes of DNS queries with unusually long subdomains from a single process on a device. It aggregates DNS connection inspection events, extracts the subdomain length, and then summarizes the count of queries, unique domains, and average subdomain length within a 10-minute window. An alert is triggered if the query count exceeds 100 or if more than 50 unique domains are observed, combined with subdomain lengths greater than 30 characters.
Microsoft Sentinel (KQL)
