ATT&CK T1572 - DNS Tunneling: High Entropy Subdomain

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects potential DNS tunneling activity by identifying DNS queries with high entropy subdomains. Specifically, it looks for subdomains that consist of 30 or more alphanumeric characters (a-z, 0-9). A threshold is applied, triggering an alert if 5 such queries are observed from the same source IP within a 60-second window. This pattern is often indicative of data exfiltration or command and control communication over DNS.