Lion Cipher Lab

Write a DNS-tunneling / exfiltration detector from scratch (evade it with low-and-slow, then re-tune)

• Threat Intel Analyst
• Advanced
• ~85 min
• Free · no account required

Why it matters

Almost every network blocks arbitrary outbound traffic -- except DNS. Port 53 has to be open for the internet to work at all, and most egress filters wave it through without inspecting the payload. That makes DNS a near-universal covert channel: an attacker who owns a domain can encode stolen files into the subdomain LABELS of queries to that domain (data going OUT) and receive commands back in the answers, quietly turning name resolution into a two-way tunnel that firewalls and proxies never see. MITRE ATT&CK tracks the command-and-control side as Application Layer Protocol: DNS (T1071.004)…

What you'll learn

• what DNS tunneling / exfiltration is and why it slips past egress controls (MITRE ATT&CK T1071.004 and T1048)
• generating a self-contained, seeded synthetic DNS query log: normal browsing/CDN/mail/update traffic plus a controlled DNS-tunnel exfil channel -- written purely as BENIGN labeled test data that connects to nothing
• engineering detection features from first principles: per-query subdomain-label length and Shannon entropy, base32/base64/hex encoding signature, record-type mix (TXT/NULL/CNAME), and per-parent aggregates -- distinct-subdomain count, query rate/volume, and the uplink/downlink byte ratio
• hand-tuning a per-parent scorer and reporting precision, recall, and a confusion matrix on data you can inspect query by query
• confronting the honest false positives: a busy CDN and an analytics host that ALSO mint many distinct subdomains, and proving the uplink/downlink ratio is what separates them from exfil
• playing the adversary: switching the tunnel to LOW-AND-SLOW (throttled rate, short padded labels, A records instead of TXT) and watching volume/rate-based recall collapse from 1.000 to 0.000
• re-tuning to per-parent aggregation over a longer window (cumulative distinct-subdomain count, uplink/downlink ratio, aggregate encoded-label entropy) to recover 1.000 recall without regressing the fast-tunnel case
• the judgment: when statistical/lexical detection wins vs when you need protocol/context signals (NXDOMAIN patterns, resolver logs, passive DNS), the base-rate flood problem, and where Zeek/Suricata/ML classifiers fit as the productionised form

Steps in this lab

1. What DNS tunneling is, why it slips egress controls, and how this lab differs from its siblings
2. Generate a self-contained DNS query log (normal traffic + one hidden tunnel)
3. Build the detection features from first principles
4. Score, classify, and print precision / recall + a confusion matrix
5. Meet the honest false positives -- the busy CDN and the analytics host
6. The adversary round: switch to LOW-AND-SLOW and watch recall collapse
7. Re-tune: per-parent aggregation on the signals a tunnel cannot shed
8. The judgment: when statistics win, the base-rate trap, and where the tools fit

Open the full interactive lab →