Using Splunk to Detect DNS Tunneling

DNS tunneling is a method to bypass security controls and exfiltrate data from a targeted organization. Choose any endpoint on your organization's network, using nslookup, perform an A record lookup for www.sans.org. If it resolves with the site's IP address, that endpoint is susceptible to DNS...

By

Steve Jaworski

June 1, 2016

All papers are copyrighted. No re-posting of papers is permitted

Related Content

Coolest Careers Poster

SANSがおすすめするサイバーセキュリティの仕事20選: ブルーチーマー - オールラウンドなディフェンダー

ブルーチーマー - オールラウンドなディフェンダーの主な業務や、スキルアップのためのSANSのおすすめのコースを紹介します！

Coolest Careers Poster

SANSがおすすめするサイバーセキュリティの仕事20選: 最高情報セキュリティ責任者（CISO）

最高情報セキュリティ責任者（CISO）の主な業務や、スキルアップのためのSANSのおすすめのコースを紹介します！

5 Advantages of Taking Your Next Blue Team Course via SANS OnDemand

There’s a lot going on in the world right now, but one thing that many experts seem to agree on is that now is the time for the cybersecurity community to be vigilant. Attacks are on the rise and it’s never been more important to keep your skills sharp and ready to defend.If you’re a cyber defender...