DNS Tunneling C2 Detection - High Volume, Long Subdomains, TXT Queries

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•4

This rule detects anomalous DNS query activity that may indicate command and control (C2) or data exfiltration over the DNS protocol. It monitors for three specific indicators: excessive query volume to a single domain family within a short timeframe, the use of abnormally long DNS subdomain labels, and the transmission of TXT record queries from endpoints not acting as designated DNS servers.