Possible DNS tunneling - high-volume abnormally long DNS query pattern for C2 concealment

Duo Tech@duotech

•updated Aug 11, 2026•3•0•12

Detects encapsulated C2 traffic over non-standard ports and DNS/HTTP tunneling patterns using entropy/volume thresholds and sustained-pattern requirements to avoid matching ordinary long DNS queries, excluding known legitimate tunneling tools/VPN endpoints.