Detection Engineering
DNS Tunneling Detection
How to detect DNS tunneling without an ML model — query length, entropy, and frequency thresholds, a Suricata rule and a Zeek/SPL analytic, plus egress hardening.
#exfiltration
1 article
1 article
How to detect DNS tunneling without an ML model — query length, entropy, and frequency thresholds, a Suricata rule and a Zeek/SPL analytic, plus egress hardening.