DNS-Based Data Exfiltration via Abnormally Long or Tunneled Query Names

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•3

This rule monitors DNS queries for potential exfiltration or C2 communication channels. It flags DNS queries that exceed 100 characters in length or contain labels with at least 30 alphanumeric characters, excluding activity from common web browsers.