Using Splunk to Detect DNS Tunneling

DNS tunneling is a method to bypass security controls and exfiltrate data from a targeted organization. Choose any endpoint on your organization's network, using nslookup, perform an A record lookup for www.sans.org. If it resolves with the site's IP address, that endpoint is susceptible to DNS...

By

Steve Jaworski

June 1, 2016

All papers are copyrighted. No re-posting of papers is permitted

Related Content

CD - Blog - Strengthen Your Supply Chain Security with Effective SBOM Management_340 x 340.jpg

September 10, 2024

Strengthen Your Supply Chain Security with Effective SBOM Management

Explore the SBOM lifecycle and why effective SBOM management is vital for enhancing security, ensuring compliance, and fostering transparency.

CD - Blog - Maximizing Vendor Risk Assessments_340 x 340.jpg

Maximizing Vendor Risk Assessments

Uncover crucial strategies to improve your vendor risk assessments.

Cybersecurity Insights, Digital Forensics, Incident Response & Threat Hunting, Cyber Defense, Cloud Security, Open-Source Intelligence (OSINT), Cybersecurity Leadership, Security Awareness, Artificial Intelligence (AI)

December 18, 2023

Top 15 SANS Summit Talks of 2023

This year, SANS hosted 16 Summits with 209 talks. Here were the top-rated talks of the year.