How do you detect DNS C2?

Detect DNS C2 and tunneling from resolver logs by scoring each (host, parent-zone) pair on query volume, subdomain-label entropy and length, unusual record types (TXT/NULL/CNAME) and NXDOMAIN ratio, then alerting only on the combination. Tools like Zeek with RITA and SigmaHQ DNS-tunneling rules provide strong baselines. The main false-positive source is legitimate high-volume vendor telemetry (CDN, AV/EDR cloud lookups), so allowlist those zones first and decode a sample of suspect labels to confirm structured payloads.

Detecting DNS C2 and Tunneling Beacons

When HTTP egress is locked down, attackers fall back to DNS: Beacon's DNS listener, Sliver DNS mode, dnscat2 and iodine all encode command and control into queries and responses. The traffic hides in plain sight, but it has a distinctive statistical shape your resolver logs can expose.

Signals at a Glance

Signal	Where	ATT&CK
High-entropy / long labels under one parent zone	DNS resolver logs	T1071.004
Unusual record types (TXT, NULL, CNAME) in volume	DNS logs	T1071.004
High query volume to a single zone from one host	DNS logs	T1071.004
High NXDOMAIN ratio to one zone	DNS logs	T1071.004
Encoded data in query names (base32/hex)	DNS logs	T1048

Entropy and Volume

Tunnels and DNS beacons encode data in the subdomain label, producing high-entropy, long names and abnormal query counts per zone. Compute per-(host, zone) counts and label entropy, and rank the outliers:

// Microsoft Sentinel (KQL) - DNS tunnel/beacon candidates
let entropy = (s:string) {
    toscalar(
      print e = (strlen(s) > 0) * strlen(s)  // placeholder
    )
};
DnsEvents
| where QueryType in ("TXT","NULL","CNAME","A","AAAA")
| extend label = tostring(split(Name, ".")[0])
| extend parent = strcat_array(array_slice(split(Name,"."), -2, -1), ".")
| summarize q=count(), distinctLabels=dcount(label), avgLabelLen=avg(strlen(label)),
            nxd=countif(ResponseCode == 3)
          by ClientIP, parent, bin(TimeGenerated, 1h)
| where q > 50 and avgLabelLen > 25 and distinctLabels > 40
| extend nxdRatio = todouble(nxd) / q

Zeek users can lean on existing community scripts and RITA's DNS analysis, which score zones by subdomain count and query frequency — a strong, low-maintenance baseline.

Tuning Out the Noise

Allowlist known high-volume zones: CDNs, anti-virus/EDR cloud lookups, telemetry and content-filtering vendors generate legitimate long/high-entropy queries.
Alert on the combination (volume + entropy + record-type + NXDOMAIN ratio), never one dimension alone.
For suspected tunnels, decode a sample of labels (base32/hex) in a sandbox to confirm structured payloads before escalating.

Vetted sources

Use Zeek DNS logs with RITA, the SigmaHQ DNS-tunneling rules and your resolver's native logging (Windows DNS Analytical log, BIND query log, cloud DNS). Baseline legitimate high-volume zones first — the false-positive driver here is vendor telemetry, not attackers.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Entropy and Volume

Tuning Out the Noise

Build Detections That Fire

C2 Beaconing Detection

Detection Hub

Protocol Tunneling Detection

Domain Fronting Detection