high SPL Network experimental

DNS Tunnelling by Subdomain Volume and Label Length

Tunnels are chatty and their labels are long and random. Neither signal alone survives contact with a CDN, so this requires both within a ten minute bin.

Rule source

dns-tunnelling-volume.spl

# DNS Tunnelling by Subdomain Entropy and Volume
# T1071.004 - Application Layer Protocol: DNS
# Tunnels are chatty and their labels are random. Neither alone is enough -
# CDNs are chatty with structured labels, and one high-entropy lookup is noise.

index=dns sourcetype=dns
| rex field=query "^(?<label>[^.]+)\.(?<parent>.+)$"
| eval label_len=len(label)
| where label_len > 24
| eval entropy=round(
      (len(replace(label, "[^a-z]", "")) * 0.0 +
       len(replace(label, "[^0-9]", "")) * 1.0 +
       label_len) / label_len, 3)
| bin _time span=10m
| stats
    dc(query)        as unique_queries,
    avg(label_len)   as avg_label,
    sum(bytes_out)   as bytes_out,
    values(src_ip)   as sources
  by _time, parent
| where unique_queries > 120 AND avg_label > 30
| lookup dns_parent_allowlist parent OUTPUT allow
| where isnull(allow)
| eval note="High unique-subdomain volume under one parent zone"
| table _time, parent, unique_queries, avg_label, bytes_out, sources, note
| sort - unique_queries

Required telemetry

DNS resolver query logs

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Security vendor telemetry that encodes lookups - allowlist the parent zone
CDN and antivirus reputation lookups with long generated labels

Validation

iodine and dnscat2 in the lab; still tuning the parent-zone allowlist

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.