Best Detection of 2026 Series: DNS Tunneling - High-Entropy Subdomain Volume & Long Labels
Detects anomalous DNS traffic patterns characterized by a high volume of unique subdomains, frequent long DNS query labels, or excessive use of TXT/NULL record types. These behaviors are frequently associated with DNS tunneling, a method used by adversaries to exfiltrate data or communicate with Command and Control (C2) servers via the DNS protocol.
Cortex XDR
