How to use the DNS Exfiltration Log Analysis agent skill

What does this skill make the agent do?

The skill covers DNS tunneling, where data is encoded in subdomain labels, and domain generation algorithm (DGA) traffic, where malware produces random-looking domains. It also covers covert command-and-control (C2) channels. The agent can write Splunk searches and Python checks that flag unusually long or random-looking subdomains, high query volumes from one host, heavy TXT record use, and DNS-over-HTTPS traffic to public resolvers.

The skill's own description says it is meant for security operations teams looking for possible tunneling, malware-generated domains and C2 channels. It is not meant for general DNS troubleshooting or uptime monitoring.

• Subdomain length analysis for tunneling (Splunk)
• Shannon entropy scoring for DGA and tunneling (Python and Splunk)
• Query volume anomalies per host, including a z-score check (Splunk)
• TXT record abuse and known tunneling tool patterns (Splunk)
• DoH bypass detection against public resolver addresses (Splunk)

What do you need before installing?

The skill needs DNS query logs already ingested into a SIEM. The source names Splunk with the stream:DNS or dns sourcetype, and Zeek DNS logs. Without DNS logging, the detections have nothing to run on.

The entropy scripts need Python 3, using only the standard library math and collections modules. Passive DNS data and a baseline of normal DNS behavior are recommended but not strictly required.

• DNS query logging enabled (the source lists Windows DNS Server, Bind, Infoblox, or Cisco Umbrella)
• DNS logs in Splunk (stream:DNS or dns sourcetype) or Zeek DNS logs
• Python 3 with math and collections
• Recommended: passive DNS data and a baseline of query volume, domain distribution and TXT record frequency

How do you install the skill?

Download the skill as a ZIP from the page where you found this guide. Unzip it into one of two locations: ~/.claude/skills/ for your personal use, or a project's .claude/skills/ folder if you want the skill limited to one project.

If you use the Claude apps instead, upload the skill under Settings, then Capabilities, then Skills.

The skill folder contains SKILL.md, scripts/agent.py and references/api-reference.md. Keep this structure intact when you unzip.

• Option A: unzip into ~/.claude/skills/
• Option B: unzip into a project's .claude/skills/
• Option C: upload in the Claude apps under Settings, then Capabilities, then Skills

How do you trigger the skill with a natural request?

You do not need to type the skill name. Describe the problem in plain language. The skill's When to Use section lists the situations it is built for: suspected exfiltration that bypasses firewall or proxy controls, threat intelligence pointing to DNS-based C2, UEBA flagging unusual DNS volume from a host, or malware analysis showing DoH or tunneling.

Good requests name the data you have and the question you need answered. Include the SIEM, the time window and, if you have them, the host or domain you are worried about.

• Write Splunk searches that flag DNS queries with unusually long subdomains over the last 24 hours
• Score the subdomains in these DNS query records for entropy and tell me which hosts look like DGA traffic
• Find hosts with TXT query counts over 100 and rank them by volume
• Check whether any hosts are sending DNS over HTTPS to public resolvers like 8.8.8.8 or 1.1.1.1

How do the detections work and what do the thresholds mean?

The subdomain length check in the source flags subdomains longer than 50 characters and then groups results by registered domain. The DGA check looks for second-level domains longer than 12 characters with few vowels or many digits. The volume check flags hosts whose hourly query count has a z-score above 3 or more than 5000 queries.

For entropy, the reference file gives these bands: below 2.5 is a normal domain, 2.5 to 3.5 is borderline and worth monitoring, above 3.5 is suspicious, and above 4.0 is high confidence. The source's Python example uses 3.5 as its threshold for a subdomain being likely tunneling or DGA.

• Subdomain length over 50 characters (tunneling)
• Second-level domain over 12 characters with vowel ratio below 0.2 or digit ratio above 0.3 (DGA)
• Hourly z-score above 3 or over 5000 queries (volume)
• TXT counts above 100, 500 and 1000 map to medium, high and critical labels
• Entropy bands: under 2.5 normal, over 3.5 suspicious, over 4.0 high confidence

What safety and validation steps should you follow?

The skill runs scripts, so read scripts/agent.py before you run it in a production environment. According to the skill's metadata, it does not use the network. Check that claim against the file yourself.

Treat every hit as a lead, not a verdict. The skill's own guidance says results should be validated by a human before blocking traffic or isolating hosts, because CDNs, anti-virus tools and telemetry services can produce false positives. Some source queries are partial examples. The final Splunk example in the source ends without a complete output clause, so review and finish any query before you rely on it.

• Read scripts/agent.py before running scripts
• Confirm no network use in your own review
• Validate every finding with a human analyst
• Expect false positives from CDNs, anti-virus and telemetry tools
• Do not block hosts or domains based on a single query result

What tips help you get useful results?

Establish a baseline first. The thresholds in the skill are starting points, and the source recommends a baseline of normal query volume, domain distribution and TXT frequency so you can tell normal from unusual in your environment.

Start with a narrow time window and one suspicious domain or host. The source's correlation example pairs DNS results with Sysmon EventCode 3 port 53 connections to identify the process making the lookups, which helps separate malware from legitimate software.

• Set a baseline before tuning thresholds
• Begin with earliest=-24h and a single host or domain
• Pair DNS hits with endpoint process data (the source uses Sysmon EventCode 3)
• Use passive DNS to check historical resolution of suspicious domains