Обнаружение утечки данных через DNS

★ 8.4 · security

analyzing-dns-logs-for-exfiltration is a Claude Code skill that examines DNS query logs to uncover data exfiltration via DNS tunneling, covert C2 channels, and DGA-generated domains. It provides ready-to-run Splunk SPL queries covering subdomain length analysis, vowel and digit ratio heuristics, Z-score-based volume anomaly detection, and TXT record abuse identification, alongside a Python implementation of Shannon entropy scoring with a threshold of 3.5 for flagging likely tunneling or DGA traffic. Designed for SOC teams investigating DNS-based threats that bypass traditional firewall and proxy controls, the skill maps to MITRE ATT&CK techniques T1048.003, T1071.004, and T1567, and aligns with NIST CSF functions DE.CM-01 and DE.AE-02.