Qradarv1.0

Potential DNS Tunneling

DNS Tunneling is a cyberattack technique that hides non-DNS data inside legitimate DNS queries and responses. Attackers encode malicious payloads, commands, or exfiltrated data within domain names, effectively using DNS traffic as a covert channel to bypass firewalls and communicate with command-and-control (C&C) servers.

By ThreatBeaconX Research Team · Updated Sep 1, 2026 · 52 views

potential-dns-tunneling.aql

SELECT LOGSOURCENAME(logsourceid),sourceip, destinationip, "<dns_url_query_field_name>","DNS Error Code",STRLEN("<dns_query_field_name>") FROM events
WHERE (LOGSOURCETYPENAME(devicetype)) ILIKE '%<DNS_logsource_type>%'
AND STRLEN("<dns_query_field_name>")>250 AND NOT INCIDR('192.X.X.0/20',sourceip)
AND "<dns_query_field_name>" IS NOT NULL
AND "<dns_query_field_name>" NOT ILIKE '%<excluded_url_1>%'
AND "<dns_query_field_name>" NOT ILIKE '%<excluded_url_2>%'
START PARSEDATETIME('8 day ago')