DNS Tunneling Detection Lab: Find the Covert Channel
DNS tunneling hides data in ordinary-looking lookups. In this lab you review synthetic resolver logs for a fictional company and make 11 scored calls: which patterns indicate dns tunneling, which are benign, what detection to build, how to contain it and what evidence to keep.
Use the DNS Lookup tool for everyday record checks, and the Detection Lab and Case Triage for related practice. All data is invented.
You are Sam Rivera, a SOC analyst at Northgate Logistics. A hunt ticket asks whether anything on the network is using DNS as a covert channel. You get synthetic resolver log excerpts (documentation domains only, invented labels) and make 11 scored decisions: which patterns point to tunnelling, which are harmless, which detections to build, how to contain, and what evidence to keep. Everything is invented; no tunnelling tool steps appear.
This is the guided version: a yellow flash shows where to click and a bar says what to do. Switch to Free play any time.
GuidedPress the highlighted Start button. You can edit the names above first, or keep the samples.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
Loading…
Sample report · illustrative data
Sample result: DNS tunneling hunt
Example run of a hunt over invented resolver logs (documentation domains only) for a fictional company, with 11 scored decisions.
Scoring
- Score
- 78% (example)
- Band
- Good hunt, some gaps
- Decisions at full marks
- 7 of 11 (example)
Signals in the invented logs
| Signal | Host | Read |
|---|---|---|
| Long random-looking labels, TXT lookups | WS-0142 | Suspicious, confirm with volume |
| Thousands of distinct subdomains of one domain | WS-0142 | Strong indicator |
| Fixed 60-second interval, low volume | SRV-0307 | Possible beacon, find the process |
| Long names from a security agent | Many hosts | Likely benign, verify and allow-list narrowly |
Missed in this example run
- Used a single signal (name length) as the alert condition
- Blocked the domain but left clients able to use any external resolver
- Reimaged the host before capturing evidence
Debrief
Tunnelling is found by combining weak signals (label length and entropy, many subdomains of one domain, TXT or NULL records, timing, response codes) against a baseline, then tying them to a process. Contain at the resolver and keep the DNS logs and host artefacts.
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
TL;DRWhat this is
5 points
- A scenario lab where you are a SOC analyst reviewing synthetic DNS log excerpts for a fictional company and deciding whether DNS is being used as a covert channel.
- You make 11 scored decisions: encoded-looking labels, one domain with many subdomains, beacon timing, NXDOMAIN ratios, separating tunnelling from legitimate long names, logging, a combined detection design, tying queries to a process, containment, encrypted DNS and evidence to keep.
- It draws on MITRE ATT&CK T1071.004 and T1572, the SANS paper Detecting DNS Tunneling, Infoblox and Palo Alto Networks explainers.
- Logs use documentation domains and invented labels only. There are no real command-and-control domains and no tunnelling tool steps.
- Defensive and educational only.
Frequently asked questions
What is DNS tunneling?
Infoblox describes it as encoding the data of other programs or protocols in DNS queries and responses. MITRE T1071.004 says adversaries use DNS to communicate with systems they control, often through DNS tunneling, to blend in with existing traffic.
How do you detect DNS tunneling?
Palo Alto Networks points to long subdomains, high character entropy, a high volume of requests to a single domain with varied subdomains, abnormal activity from one client, and TXT records returned unexpectedly or at volume. SANS describes payload analysis and traffic analysis, and calls traffic analysis the option that can be used universally. Combining signals against your own baseline is PlayCISO practice.
What does DNS exfiltration detection look for in logs?
Names, record types, response codes, client and time, which is why summary counts are not enough. Palo Alto notes many DNS logs record domain names rather than payload content. Useful fields include distinct subdomains per parent domain, label length, TXT or NULL share and regularity of timing.
Is a long DNS name always tunneling?
No. Some security agents and CDNs use long or encoded-looking names legitimately. Verify against vendor documentation and a baseline, then allow-list narrowly. The lab includes this trap.
How do you stop DNS tunneling?
MITRE mitigation M1037 recommends filtering DNS requests to unknown, untrusted or known bad domains, and notes that resolving DNS through on-premise or proxy servers may disrupt concealed data. Palo Alto adds redirecting queries through internal resolvers, sinkholing, and caution about blocking TXT entirely.
Is this a DNS tunneling lab with real tools?
No. It is a decision exercise on invented logs scored out of 100, with a debrief on each call. It contains no real malicious domains and no instructions for running a tunnel. Lines labelled PlayCISO practice are our own reasoning.
Sources
Read on 2026-11-08. Lines in the feedback marked “PlayCISO practice” are our own reasoning, not a statement by any source. The scenarios are fictional and use made-up data.
- MITRE ATT&CK T1071.004: Application Layer Protocol: DNS (DNS C2, DET0400 analytics, M1037)
- MITRE ATT&CK T1572: Protocol Tunneling (tunnelling, DNS over HTTPS)
- SANS: Detecting DNS Tunneling (Farnham, 2013) (payload vs traffic analysis)
- Infoblox: What is DNS tunneling? (definition)
- Palo Alto Networks: What is DNS tunneling? (indicators and mitigations)
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.