← All cheat sheets

DNS LOG ANALYSIS

Plain-text reference · 4 KB. Read it, search it (Ctrl-F) or print it.

DNS is a high-signal, high-volume telemetry source. Attackers use it for C2
beaconing, data exfiltration (tunneling), and domain-generation algorithms
(DGA). This sheet covers what to log, which indicators matter, and how to
triage them defensively.

WHERE DNS TELEMETRY COMES FROM#

- Resolver query logs (BIND query log, Unbound, dnsmasq, Windows DNS
  Analytical/Audit logs, Pi-hole).
- Passive DNS sensors / Zeek dns.log.
- Endpoint: Sysmon Event ID 22 (DnsQuery) with Image + QueryName.
- Windows DNS Server: "Microsoft-Windows-DNS-Server/Analytical" (ETW).
- Firewall / proxy DNS fields.

Useful fields to collect per query:
  timestamp, client/source IP, query name (FQDN), query type (A/AAAA/TXT/
  CNAME/NULL/MX), response code (rcode), answer IPs, TTL, resolver, and
  (endpoint) the process that issued it.

KEY SUSPICIOUS INDICATORS#

1. HIGH ENTROPY / RANDOM-LOOKING LABELS
   - DGA domains look random: "x7f3k9qz2m.com". Measure Shannon entropy of
     the second-level label; high entropy + no vowels is a flag.
   - Many NXDOMAIN responses from one host = malware cycling DGA domains.

2. LONG QUERY NAMES / MANY SUBDOMAIN LABELS
   - Tunneling encodes data into subdomains:
     "aGVsbG8.<data>.<data>.tunnel.example.com".
   - Watch total FQDN length (e.g. > 50-100 chars) and label count.

3. UNUSUAL RECORD TYPES AT VOLUME
   - High rates of TXT, NULL, or CNAME to one domain suggest tunneling
     (TXT/NULL carry more bytes). A/AAAA are normal; sustained TXT is not.

4. HIGH QUERY VOLUME TO ONE DOMAIN / BEACONING
   - Regular, periodic queries to the same domain (fixed interval +/- jitter)
     indicate C2 beaconing. Look at inter-query timing variance.

5. RARE / NEWLY-REGISTERED / SUSPICIOUS TLDs
   - Correlate with domain age (passive DNS / whois). Freshly registered
     domains and abuse-heavy TLDs warrant scrutiny (not automatic blocks).

6. NXDOMAIN SPIKES
   - A single endpoint generating many NXDOMAIN answers = DGA or misconfig.

7. DNS TO NON-CORPORATE RESOLVERS
   - Endpoints querying 8.8.8.8/1.1.1.1 directly (bypassing internal
     resolvers) or using DoH endpoints can indicate evasion.

8. FAST-FLUX
   - One domain resolving to many IPs with very low TTLs, rotating rapidly.

ENTROPY -- QUICK INTUITION#

Shannon entropy H = -sum( p_i * log2(p_i) ) over characters.
- Normal English domains: lower entropy, pronounceable.
- Random/base32/hex labels: higher entropy.
Use entropy as ONE feature, combined with length, consonant ratio, and
digit ratio -- never as a sole verdict (CDNs use random-looking names too).

TRIAGE QUERIES / ONE-LINERS (on exported logs)#

# Top queried domains
awk '{print $QNAME_COL}' dns.log | sort | uniq -c | sort -rn | head -30

# NXDOMAIN count per client (DGA hunt) -- Zeek dns.log has rcode_name
zeek-cut id.orig_h rcode_name < dns.log | awk '$2=="NXDOMAIN"{c[$1]++}
  END{for(h in c) print c[h], h}' | sort -rn | head

# Longest query names (tunneling hunt)
zeek-cut query < dns.log | awk '{print length, $0}' | sort -rn | head -20

# TXT-record queries (tunneling-prone)
zeek-cut query qtype_name < dns.log | awk '$2=="TXT"' | sort | uniq -c |
  sort -rn | head

# Sysmon 22 on an endpoint (PowerShell)
Get-WinEvent -LogName Microsoft-Windows-Sysmon/Operational |
  Where-Object Id -eq 22 |
  Select-Object TimeCreated,
    @{n='Img';e={$_.Properties[4].Value}},
    @{n='Query';e={$_.Properties[5].Value}}

BASELINE BEFORE ALERTING#

- CDNs, cloud storage, telemetry, and AV all produce long/random-looking
  names and high volume. Build an allowlist of known-good high-volume
  domains first.
- Alert on CHANGE: a host that suddenly queries a new domain thousands of
  times, or starts using TXT records it never used before.

ENRICHMENT (safe, defensive)#

- Domain age / registration -> whois, passive DNS.
- Reputation -> threat-intel feeds, URLhaus, known-DGA feeds.
- Resolve the answer IPs and check their ASN/geo for anomalies.
- Correlate the querying PROCESS (Sysmon 22) -- a browser querying a domain
  is different from rundll32/regsvr32 doing so.

Remember: blocking a C2 domain can tip off an attacker mid-investigation.
Coordinate sinkholing/blocking with the IR plan.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.