DNS Exfiltration Log Analysis
Hunts DNS logs for tunneling, DGA domains and covert C2 traffic using entropy and volume checks
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
This skill teaches an AI agent how a security analyst hunts for data being smuggled out of a network through DNS, the internet's address lookup system. Once installed, the agent can write Splunk searches and Python checks that flag unusually long or random-looking subdomains, high query volumes from one host, heavy TXT record use, and DNS-over-HTTPS traffic to public resolvers. It is meant to help security operations teams find possible tunneling, malware-generated domains and command-and-control channels.
Great for
- SOC analysts who already collect DNS logs in Splunk, Zeek, or a similar SIEM and want ready-made detection queries
- Security engineers building or tuning DNS threat-hunting rules
- Students learning how DNS tunneling and DGA detection work
Skip it if
- General DNS troubleshooting or uptime monitoring, which the skill itself says it is not for
- Environments without DNS logging, since the detections need query logs to run, and any result should be validated by a human before blocking traffic or isolating hosts (false positives from CDNs, anti-virus, and telemetry tools are likely)
Try asking
- “Write a Splunk search that finds hosts sending DNS queries with unusually long subdomains”
- “Check these DNS query samples for high-entropy strings that could indicate DGA domains”
- “Build a TXT record volume alert for our SIEM and explain the severity thresholds”
- “Help me detect DNS-over-HTTPS traffic to public resolvers from our proxy logs”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-dns-logs-for-exfiltration.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-dns-logs-for-exfiltration.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-dns-logs-for-exfiltration.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Tune the thresholds (subdomain length above 50, entropy above 3.5, query counts) against your own normal traffic baseline before alerting
- Review scripts/agent.py before running it, since it executes locally and processes your DNS records
- Run the Splunk searches in a test index first, as some use broad searches over 24 hours of data
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.