Sunturai
Back to results
MediumElastic detection rulesElastic

Potential DNS Tunneling via NULL or Long DNS Queries

Identifies DNS query patterns associated with tunneling, including rare NULL queries, repeated TXT queries with unusually long names, and clients generating many unique, long subdomains under one registered domain…

Description

Identifies DNS query patterns associated with tunneling, including rare NULL queries, repeated TXT queries with unusually long names, and clients generating many unique, long subdomains under one registered domain within a five-minute window.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Sign in to read itCreate an account

Detection requirements

Platform
ESXiIaaSLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the 3 ATT&CK techniques it maps to.

Known benign triggers

  • CDN, cloud load-balancer, software-update, and telemetry hostnames can be long and change often. Recursive resolvers, forwarders, NAT gateways, and localhost DNS listeners can also combine queries from many endpoints under one client address. DNS research, testing, and security tools can generate NULL or unusually long TXT queries. Validate the apex domain and whether the source is an endpoint before treating the activity as tunneling.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice