# Dns And Proxy Hunting > Use when hunting DNS and web-proxy logs for C2, exfiltration, and malicious domains — high-value logs that reveal what hosts are really talking to. - Skill: `jihedbfr-art/dns-and-proxy-hunting` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add jihedbfr-art/dns-and-proxy-hunting` - Raw SKILL.md: https://api.skillmd.com/api/skills/jihedbfr-art/dns-and-proxy-hunting/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: jihedbfr-art (https://skillmd.com/u/jihedbfr-art) - Updated: 2026-09-21 - Page: https://skillmd.com/skills/jihedbfr-art/dns-and-proxy-hunting --- ## Prerequisites - Target system, dependencies and environment configured. ## Usage ### Purpose DNS and web-proxy logs are among the richest hunting sources, because almost everything a host does on the internet passes through name resolution and web requests. Malware resolving C2 domains, data tunnelled out through DNS, connections to newly-registered or algorithmically-generated domains — it all shows here. This skill covers hunting these logs for the network signatures of compromise, a high-yield hunt available to almost any SOC. ### When to use it Hunting for C2, exfiltration, and malicious-domain contact, especially when you don't have specific IoCs. DNS and proxy logs are widely collected and high-signal, making this one of the most accessible and productive network hunts. ### Procedure 1. **Get the DNS and proxy logs with enough history.** DNS query logs (what domains hosts resolve) and proxy logs (web requests, with URLs, user-agents, bytes, categories) are the data. History lets you spot patterns and rare/new domains. 2. **Hunt DNS tunnelling / exfiltration.** Data smuggled through DNS shows as anomalous query volume from a host, abnormally long or high-entropy subdomain labels (encoded data), lots of TXT/NULL queries, and high query frequency to one domain (ties into the DNS-security skill's signatures). One host resolving thousands of long random subdomains under one domain is exfiltration. 3. **Hunt newly-registered and algorithmic (DGA) domains.** Malware often uses freshly-registered domains (low age) or DGA (algorithmically-generated, random-looking) domains for C2. Hunt for connections to newly-seen/newly-registered domains and to domains with high randomness/entropy in the name — legitimate traffic rarely goes to these. 4. **Hunt suspicious proxy patterns.** Uncategorised or newly-categorised domains, unusual user-agents (a non-browser user-agent, or a tool's default), direct-to-IP requests, and abnormal request timing (beaconing — see that skill). The user-agent and category fields are especially useful. 5. **Hunt for known-bad and rare destinations.** Rare domains contacted by only one host, connections to uncategorised or high-risk categories, and (with threat intel) known-malicious domains. Rarity is a strong prioritisation signal — the domain nothing else talks to. 6. **Filter the enormous legitimate volume.** DNS/proxy logs are huge and mostly benign; baseline normal, allowlist the known-good (CDNs, major services), and focus on the anomalous. This filtering is the main effort. 7. **Investigate and operationalise** — a confirmed malicious domain becomes an IoC and a DNS/proxy block; the pattern becomes a detection (feeds detection, threat-intel, and DNS-security). ### Cheatsheet ``` DNS + proxy logs = richest hunting sources (almost all internet activity passes through) high-yield, widely collected. need HISTORY. hunt these DNS TUNNELLING/exfil: high query volume | long/high-entropy subdomains | TXT/NULL floods | high frequency to one domain (one host -> 1000s of random subdomains = exfil) NEW/DGA domains: low domain age (newly-registered) | high name randomness/entropy (legit traffic rarely goes here) PROXY anomalies: uncategorised/new-category domain | odd user-agent (non-browser/tool default) | direct-to-IP | beaconing timing RARE destinations: domain contacted by only ONE host | high-risk category | known-bad (intel) FILTER huge legit volume: baseline + allowlist CDNs/major services -> anomalous surface investigate -> IoC + DNS/proxy block + detection ``` ### Reading the hunt - **A host resolving thousands of long, high-entropy subdomains under one domain** = DNS tunnelling/exfiltration; the volume-and-entropy signature is unmistakable and DNS is a favourite exfil channel because it's usually allowed out. A top find. - **Connections to newly-registered or DGA (random-looking) domains** = strong C2 indicators; legitimate traffic rarely goes to freshly-registered or algorithmic domains, so these stand out sharply. - **A rare domain contacted by only one host** = high-value lead; rarity is one of the best prioritisation signals — the destination nothing else in the org talks to is worth investigating. - **An unusual user-agent in proxy logs** (a tool's default, a non-browser string) = often malware or a script rather than a user; the user-agent field frequently betrays automated/malicious traffic. - **Overwhelming legitimate volume** = the challenge; DNS/proxy logs are mostly benign (CDNs, major services), so baselining and allowlisting known-good is most of the work before the malicious surfaces. - **A confirmed malicious domain** = block it at the resolver/proxy, extract as an IoC, and turn the pattern into a detection. ### Pitfalls - **Not filtering the legitimate volume.** DNS/proxy logs are enormous and mostly benign; without baselining and allowlisting known-good, the malicious signal drowns. Filtering is the main effort. - **Ignoring DNS as an exfil/C2 channel.** DNS is almost always allowed outbound, which is exactly why attackers use it; not hunting DNS leaves a common channel unwatched. - **Hunting only known-bad domains.** Chasing IoCs misses C2 on new/DGA domains; hunt the behaviours (tunnelling signature, domain age/entropy, rarity) that catch unknown infrastructure. - **Overlooking the user-agent and category fields.** Proxy metadata (user-agent, domain category, bytes) is high-signal for spotting non-human/malicious traffic; don't hunt on destination alone. - **Insufficient history.** Spotting rare domains and repeating patterns needs a time span; a short window misses slow or infrequent activity. ### References - The network dns-security, beaconing-detection, and detection log-source-coverage skills - MITRE ATT&CK — T1071.004 (DNS), T1048 (Exfiltration Over Alternative Protocol), T1568 (Dynamic Resolution/DGA) - The threat-intelligence domain (domain reputation) and operationalising-a-hunt skill - Passive DNS and domain-age/reputation services ## Inputs - Relevant source code, logs, network traces, or system specifications. ## Outputs - Analysis findings, security audit report, or generated code artifacts.