Lion Cipher Lab
Detect DNS tunneling and exfiltration in your logs (Zeek dns.log)
- SOC Analyst / Blue Team
- Intermediate
- ~50 min
- Free · no account required
Why it matters
DNS is the one protocol almost every network lets out unfiltered — which is exactly why attackers hide in it. By encoding stolen data (or a live command channel) into the subdomain labels of lookups to a domain whose name server they control, they smuggle bytes past firewalls that would block a raw upload in a heartbeat, and pull answers back inside TXT or NULL records. It is slow and noisy on the wire, and that noise is your opening: a DNS tunnel leaves a shape no normal browsing makes — a flood of long, random-looking subdomains under one parent domain, odd record types, and a huge count of…
What you'll learn
- explaining DNS tunneling and DNS exfiltration as MITRE ATT&CK T1071.004 and T1048
- reading the Zeek dns.log fields that matter for tunneling (query, qtype_name, answers, rcode_name)
- safely generating a benign tunnel-SHAPED DNS signal on your own machine — no malware, no third party
- running Zeek over a capture to produce dns.log (zeek -r trace.pcap)
- aggregating queries per parent domain with zeek-cut + awk to surface volume
- measuring subdomain label length and a rough Shannon entropy to flag high-randomness labels
- flagging unusual record types (TXT/NULL) and high unique-subdomain counts per 2LD
- writing the detection as a rule of thumb and a Sigma/Suricata-style expression
- judgment: baselining and allowlisting CDN/AV noise, and knowing DoH/DoT hides DNS from you entirely
Steps in this lab
- What DNS tunneling is, and why attackers love DNS
- The tells — what a tunnel looks like that normal DNS doesn't
- The dns.log fields that matter
- When to reach for this — and when NOT to
- Generate a benign tunnel-SHAPED signal — safely, on your own box
- Turn the capture into dns.log with Zeek
- Here is your dns.log — baseline it before you hunt
- Hunt 1 — volume per parent domain
- Hunt 2 — long, high-entropy labels and odd record types
- Hunt 3 — unique-subdomain count and ratio per parent
- The false positives — baseline and allowlist before you alert
- Write the detection — rule of thumb, then Sigma/Suricata-style
- The judgment — limits, and how a pro does it better