Analyzing DNS Logs for Exfiltration When to Use Use this skill when: - SOC teams suspect data exfiltration through DNS tunneling to bypass firewall/proxy controls - Threat intelligence indicates adversaries using DNS-based C2 channels (e.g., Cobalt Strike DNS beacon) - UEBA detects anomalous DNS query volumes from specific hosts - Malware analysis reveals DNS-over-HTTPS (DoH) or DNS tunneling capabilities Do not use for standard DNS troubleshooting or availability monitoring — this skill focuses on security-relevant DNS abuse detection. Prerequisites - DNS query logging enabled (Windows DNS S…