Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality. Uses scapy for packet capture analysis and statistical methods to distinguish legitimate DNS from covert channels. Use when hunting for data exfiltration.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-dns-tunneling-detectionnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-dns-tunneling-detection -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-dns-tunneling-detection -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/performing-dns-tunneling-detectiongh skill install mukul975/Anthropic-Cybersecurity-Skills performing-dns-tunneling-detectiongit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-dns-tunneling-detection ~/.claude/skills/performing-dns-tunneling-detection # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-dns-tunneling-detection ~/.agents/skills/performing-dns-tunneling-detection # Codex, Cursor, Gemini CLI, Copilot, OpenCode