Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains, oversized TXT/NULL records, and anomalous query volume or patterns. Use when investigating suspected DNS tunneling, covert C2 over DNS, or data exfiltration hidden in DNS queries against network traffic captured by Zeek.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-exfiltration-over-dns-with-zeeknpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-exfiltration-over-dns-with-zeek -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-exfiltration-over-dns-with-zeek -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-exfiltration-over-dns-with-zeekgh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-exfiltration-over-dns-with-zeekgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-exfiltration-over-dns-with-zeek ~/.claude/skills/detecting-exfiltration-over-dns-with-zeek # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-exfiltration-over-dns-with-zeek ~/.agents/skills/detecting-exfiltration-over-dns-with-zeek # Codex, Cursor, Gemini CLI, Copilot, OpenCode