Suspicious Long DNS Query (Possible Tunneling)

Darshan Thummar@Mighty

•updated Jun 5, 2026•0•0•8

This rule detects unusually long DNS queries (40 characters or more) which can be indicative of DNS tunneling. DNS tunneling is a technique used by adversaries for command and control (C2) communication or data exfiltration, where data is encoded within DNS queries and responses to bypass network security controls.