The length of a DNS query can often be an indicator of suspicious activity. Typical domain name lengths are short, whereas the domain name query used for data exfiltration or tunneling can often be very large in size. This is because they could be encoded using base 64/32 etc. The hunting query looks for Names that are more than 150 characters in length. Due to a lot of services using long DNS to communicate via procedurally generated long domain names, this can be problematic, so a number of known services are excluded from this query. Additional items might need to be added to this exclusion, depending on your environment.

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.