ATT&CK T1572 - DNS Tunneling: Oversized DNS Query

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects potential DNS tunneling activity by identifying unusually large DNS queries. Specifically, it looks for UDP packets on port 53 (DNS) that contain the DNS query header (01 00 00 01) and have a data size greater than 100 bytes. A threshold of 10 such queries from the same source within 60 seconds is set to reduce false positives.