Detecting DNS Tunneling and High-Volume Data Exfiltration with Sentinel KQL

DNS is rarely blocked by enterprise egress firewalls, making it an attractive covert communication channel for Command and Control (C2) frameworks (e.g., Iodine, Cobalt Strike DNS beacons). Adversaries encode stolen data into subdomains (e.g., <base64-data>.c2.example.com) or transfer commands via TXT records.

Here is how to hunt for DNS tunneling with Microsoft Sentinel.

Required Log Source

• Windows DNS Server or Infoblox/BIND forwarders streaming into DnsEvents.

DNS Tunneling Detection KQL Query

// Detect Anomalously Long DNS Queries and High Distinct Subdomain Counts
let timeRange = 24h;
let queryLengthThreshold = 35;
let distinctSubdomainThreshold = 50;
DnsEvents
| where TimeGenerated >= ago(timeRange)
| where QueryType in ("TXT", "A", "AAAA")
| extend DomainParts = split(Name, ".")
| extend DomainLength = strlen(Name)
| where DomainLength >= queryLengthThreshold
| extend RootDomain = strcat(DomainParts[-2], ".", DomainParts[-1])
| summarize 
    TotalQueries = count(),
    UniqueQueries = dcount(Name),
    AvgQueryLength = avg(DomainLength),
    MaxQueryLength = max(DomainLength),
    TxtQueryCount = countif(QueryType == "TXT")
    by ClientIP, RootDomain
| where UniqueQueries >= distinctSubdomainThreshold
| project ClientIP, RootDomain, TotalQueries, UniqueQueries, AvgQueryLength, MaxQueryLength, TxtQueryCount
| order by UniqueQueries desc

Technical Indicators

1. Long Subdomain Strings: Tunneling protocols encode data chunks directly into DNS query labels, causing queries to exceed 40 characters.
2. High Count of Unique Queries per Root Domain: Standard web surfing repeatedly requests the same 2–3 FQDNs. Tunneling queries change every second because each query carries unique encoded data packets.
3. Preponderance of TXT Queries: Inbound C2 traffic often arrives in DNS TXT responses due to larger data capacity.

MITRE ATT&CK Mapping

• Tactic: Command and Control (TA0011), Exfiltration (TA0010)
• Technique: Application Layer Protocol: DNS (T1071.004), Exfiltration Over Alternative Protocol (T1048)