The Challenge: Spotting Stealthy DNS Data Exfiltration
DNS is the most trusted protocol on any enterprise network — and advanced threat actors know it. Because almost all corporate firewalls explicitly allow outbound UDP traffic on port 53, attackers routinely hide command-and-control (C2) channels and exfiltration payloads inside legitimate-looking DNS queries.
The result: security teams hunting for Data Exfiltration over alternative protocols are buried under millions of legitimate queries from web browsing, cloud telemetry, and antivirus updates. The malicious traffic blends in perfectly — and manual analysis can take days.
Applying basic Wireshark display filters like dns.qry.name.len > 50 or dns.qry.type == 16 (TXT records) yields thousands of false positives daily from legitimate CDNs and endpoint tracking domains.
Detecting Domain Generation Algorithms (DGA) mathematically requires exporting PCAP files to CSV and running custom Python entropy scripts across hundreds of thousands of queried domains — before you've even found the threat.
The Solution: Automated DNS Payload Analysis
PcapAI does the counting for you. Queries are grouped by client and registrable domain, and every name is classified: long high-entropy labels (hex, base32, base64), raw binary labels, NULL or private-use record types. A tunnel needs 20 or more such names under one domain within 60 seconds, and answers that carry data mark the return channel.
-
✦
MITRE T1071.004 (Application Layer Protocol: DNS): in the sample report,
10.0.2.30sent 222 queries whose names carried encoded data topirate.seathrough resolver10.0.2.20, and the answers carried data back — a two-way tunnel through name resolution in 24 seconds. -
✦
MITRE T1568.002 (Domain Generation Algorithms): flags algorithmically generated domains (e.g.,
x8f9q2p.malicious.com) exhibiting high Shannon entropy — detecting malware variants that routinely bypass static threat intelligence blocklists. - ✦ Thresholds Instead of Guesswork: one random CDN name, repeated polling or a DKIM TXT record is not a tunnel. The detector needs many distinct encoded names under one domain in a short window, which removes the false positives that make manual analysis so slow.
-
✦
Root Cause Correlation: automatically links the tunnel back to the internal host that runs it (in the sample,
10.0.2.30), with the frames as evidence, giving incident responders the exact target for immediate quarantine.
Wireshark Manual Analysis vs. PcapAI
Manual (Wireshark)
Exporting DNS logs to CSV, running custom Python entropy scripts, and manually sorting through CDN false positives. Process takes 1–3 hours.
PcapAI
Every query name classified, DGA domains scored and the tunnel mapped to MITRE ATT&CK. Free summary in about two minutes for captures up to 20 MB.
How It Works
Upload Your PCAP
Drop any .pcap or .pcapng file. No installation, no account required. Works with captures from any network device.
PcapAI Checks Every DNS Query
The engine classifies every query name, detects DGA patterns and groups queries by client and domain — across every DNS record in your capture.
Get the Infected Host
Receive a full report with the C2 domain, infected endpoint IP, MITRE ATT&CK mappings, and containment steps — ready to act on immediately.
Frequently Asked Questions
How do you detect DNS tunneling in Wireshark?
To manually detect DNS tunneling in Wireshark, analysts typically filter for long queries using dns.qry.name.len > 50 or unusual TXT records with dns.qry.type == 16. This produces massive false positives from legitimate CDNs and requires custom Python entropy scripts to identify DGA domains — a process that can take 1–3 hours on a large capture. PcapAI runs the entropy and volume checks on every query and names the tunnelling host and domain.
What is MITRE ATT&CK T1071.004?
MITRE ATT&CK T1071.004 describes adversaries using DNS as an Application Layer Protocol to communicate with C2 servers or exfiltrate sensitive data. Attackers favor this technique because port 53 is rarely blocked by corporate firewalls, making DNS an ideal covert channel for both data theft and persistent malware beaconing.
What is a Domain Generation Algorithm (DGA)?
A Domain Generation Algorithm is a technique used by malware to automatically produce large numbers of pseudo-random domain names that act as potential C2 rendezvous points. Instead of hardcoding a C2 server address — which can be easily blocklisted — the malware generates hundreds of domains daily, with only the attacker knowing which ones are active. DGA domains typically exhibit high Shannon entropy and unusual character distributions that distinguish them from legitimate domain names.
Can DNS tunneling bypass a firewall?
Yes — and that is exactly why attackers use it. Most corporate firewalls allow outbound DNS traffic on UDP port 53 without inspection. By encoding data inside DNS query subdomains or TXT record responses, an attacker can exfiltrate gigabytes of data or maintain a persistent C2 channel through firewalls that would block any other outbound connection. Deep packet inspection at the DNS payload level — as PcapAI performs — is required to detect it.
What tools detect DNS tunneling automatically?
Live network monitoring tools like Zeek and Suricata can alert on DNS anomalies in real time, but require significant tuning to reduce false positives. For post-incident forensics from a PCAP file, PcapAI automates the full analysis — entropy scoring, DGA detection, MITRE ATT&CK mapping, and infected host identification — without any manual filtering or scripting.
Related Use Cases
Is there a C2 beacon in your traffic?
Upload a PCAP from your network: the free summary takes about two minutes, and uploads without an account are deleted after 24 hours. Or see packs and plans.
Sample Report: Executive Summary
