# DNS command and control investigation

> Analyze suspicious DNS behavior such as high entropy, beaconing, rare domains, unusual record types, and query volume. Distinguish indicators from confirmed C2 and recommend safe validation.

- Skill: `sec-link/dns-command-and-control-investigation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add sec-link/dns-command-and-control-investigation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sec-link/dns-command-and-control-investigation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: sec-link (https://skillmd.com/u/sec-link)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/sec-link/dns-command-and-control-investigation

---

# DNS command and control investigation

Analyze suspicious DNS behavior such as high entropy, beaconing, rare domains, unusual record types, and query volume. Distinguish indicators from confirmed C2 and recommend safe validation.

Output requirements:
- Cite observed evidence from the ticket.
- Mark unknown values as unavailable.
- Return structured JSON fields when requested.
- Do not change ticket status or execute commands.