Skill UI

This skill analyzes DNS query logs to detect sophisticated threats such as data exfiltration via DNS tunneling, Domain Generation Algorithm (DGA) usage, and covert Command and Control (C2) channels. It utilizes advanced techniques like entropy analysis, query volume anomaly detection, and subdomain length analysis within SIEM platforms, helping SOC teams identify threats that bypass traditional network security controls.

This skill provides a comprehensive framework for detecting data exfiltration attempts that utilize DNS tunneling. It analyzes DNS logs for anomalies such as high Shannon entropy in subdomains, excessive query volume, abnormal query lengths, and misuse of TXT/CNAME records. It is ideal for SOC analysts and security engineers building advanced threat detection rules and performing threat hunting.

This skill provides a methodology to detect data exfiltration attempts hidden within DNS queries. By analyzing Zeek dns.log files, the agent computes Shannon entropy of subdomains, flags unusually long labels, and monitors unique subdomain counts per parent domain. This technique is crucial for identifying malicious tunneling tools like dnscat2 or iodine that bypass traditional security controls.

This skill detects covert data exfiltration occurring over DNS tunnels. It analyzes DNS query names by computing Shannon entropy, examining query length distributions, and identifying high subdomain cardinality. It is essential for security operations, incident response, and proactive threat hunting when suspicious or encoded DNS activity is suspected.