analyzing-dns-logs-for-exfiltration
From the author
Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert C2 channels using entropy analysis, query volume anomalies, and subdomain length detection in SIEM platforms. Use when SOC teams need to identify DNS-based threats that bypass traditional network security controls.
Install
npx skills add 26zl/cybersec-toolkit --skill analyzing-dns-logs-for-exfiltration -a claude-code
Installs to .claude/skills/analyzing-dns-logs-for-exfiltration/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 77
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- hunting-for-dns-tunneling-with-zeek26zl/cybersec-toolkitDetect DNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive query volume, long query lengths, and unusual DNS record types indicating covert channel communication.Other★ 82
- performing-dns-tunneling-detection26zl/cybersec-toolkitDetects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality. Uses scapy for packet capture analysis and statistical methods to distinguish legitimate DNS from covert channels. Use when hunting for data exfiltration.Other★ 82
- dns-securityUnitOneAI/SecuritySkillsPerforms a structured DNS security review against NIST SP 800-81 Rev 2 (Secure Domain Name System Deployment Guide) and CIS Controls v8 (Control 9.2 -- Use DNS Filtering Services). Auto-invoked when reviewing DNS configurations, DNSSEC deployment, or investigating DNS-based exfiltration and tunneling indicators. Produces a DNS security assessment covering DNSSEC validation, protective DNS, and exfiltration detection patterns.Security★ 94
- analyzing-api-gateway-access-logs26zl/cybersec-toolkitParses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.Engineering★ 82
- DNS Testing PatternsPramodDutta/qaskillsDNS configuration testing including record validation, DNSSEC verification, resolution timing, failover testing, and DNS-based service discovery.Testing★ 240
- covert-channel-assessmentzero-lab-ai/skillsAssesses covert-channel and data-egress exposure, then plans or records bounded purple-team validation with synthetic data. Use when evaluating DNS, web, cloud, ICMP, tunnel, timing, steganographic, or dead-drop paths without turning a plausible route into a claim of successful exfiltration.Planning★ 282
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in