Cybersecurity
Detecting DNS Exfiltration With DNS Query Analysis
The skill detects covert DNS exfiltration by analyzing query entropy, subdomain length, volume to single domains, and abuse of TXT, CNAME, NULL records, as well as oversized response payloads. It employs passive DNS monitoring combined with statistical and machine‑learning techniques to identify anomalies caused by tools such as iodine, dnscat2, and dns2tcp. Security teams and threat hunters use it to build passive DNS anomaly detection and to hunt for hidden data exfiltration.
- Publisher / source
- Cybersecurity Skills (Community)
- Upstream record
- mukul975/Anthropic-Cybersecurity-Skills
- Version
- Version 3
- Published
- Publication review
- Approved for publication · recorded passed scan 2026-10-22
- Content fingerprint
fc8f130b15a9e7ba91e8a55e6f7daf6022453aa5a570ace5f5d302e43289a6b5