DNS Tunneling via Long Subdomains, TXT Queries, or High Volume
This rule detects potential DNS tunneling activity used for Command and Control (C2). It monitors DNS query traffic for indicators such as excessively long or high-entropy subdomain labels, the use of specific record types often used in tunneling (TXT and NULL records), and high volumes of DNS requests to a single parent domain from a specific host within a 10-minute window.
YARA-L
