DNS Tunneling Detection Evaded by Low Entropy
Cortex XSIAM monitors DNS for 5,000 endpoints and ingests 1.3 billion queries per day. A detection rule flags any host that makes more than 200 TXT queries in 10 minutes to subdomains of the same parent domain when the subdomain label entropy exceeds 3.8. It generates 45 alerts per day; 90% come from an approved marketing analytics SaaS agent on 600 laptops, and 5% come from a research group using a DNS-based testing service. Last month a red-team exercise used DNS tunneling over TCP/53 to a domain that returned low-entropy, dictionary-like labels and stayed under the query threshold. The CISO wants fewer alerts but broader coverage. Analysts currently spend 20 minutes per DNS alert validating whether the parent domain is newly registered. The threat-intel integration can return domain age and category but is rate-limited to 300 calls per hour.
1. Evaluate the current DNS rule. Why is it both noisy and easy to evade?
Read the worked answer
The rule has two opposite problems. It is noisy because high-volume TXT queries with high-entropy labels are exactly what some SaaS analytics agents do, so 90% of alerts are expected behavior. It is also narrow because the red team used low-entropy, dictionary-like labels over TCP/53 and stayed under 200 queries, evading both the entropy and volume thresholds. Raising the threshold would worsen the blind spot. The fix is not a single threshold change; it is a layered detection that combines volume, distinct subdomain count, record type, label characteristics, domain age, process context, and host criticality. Keep the high-entropy pattern as one signal, but add low-entropy anomaly and TCP/53 coverage. Treat approved SaaS as an exception with process and pattern constraints, not as a permanent domain allowlist.
2. Design a layered XQL-based detection that catches the red-team pattern without flooding analysts.
Read the worked answer
Use XQL in stages. Aggregate DNS by host, parent domain, and 10-minute bucket: count queries, distinct subdomains, TXT and NULL ratio, average label length, and label entropy. Join threat-intel domain age and category, and join endpoint process data so the query can see whether the resolver is a known browser or an approved agent. Score risk: newly registered domain, high distinct-subdomain count, TXT-heavy responses, non-browser process, critical asset, and regular beaconing intervals. Alert at two levels: high for critical assets or newly registered domains with tunneling-like patterns, medium for anomalous volume on non-critical hosts. Include TCP/53 and long TXT responses. This catches the red-team low-entropy case through distinct subdomains and process context rather than entropy alone.
3. How should the team allowlist the SaaS and research traffic without creating a blind spot?
Read the worked answer
Allowlist by the full pattern, not the parent domain alone: approved parent domain, expected subdomain shape, expected record type, and approved process hash or path. Require an owner and a 90-day expiry, and review volume changes. For the marketing SaaS, allow only the agent process on the 600 laptops; if a browser or PowerShell starts querying the same domain with high-entropy subdomains, alert. For the research group, allow only their test domains and keep alerts for other suspicious parents. This avoids a blind spot where an attacker uses the trusted domain or a compromised SaaS agent. Revisit exceptions quarterly and remove any that no longer have a business owner.