DNS Tunneling C2: High-Entropy Subdomains, TXT/NULL Abuse & Low IP Diversity

Ibrahim Saud@tektrix

•updated Sep 24, 2026•1•0•0

This rule identifies potential DNS tunneling activity (often used for C2 or data exfiltration) by analyzing DNS queries for anomalous patterns. It looks for high-entropy or excessively long subdomain labels, frequent use of suspicious record types like TXT or NULL, and high query volume to a single parent domain with low diversity in resolved IP addresses.