DNS tunnelling pattern

exfil_dns_tunnel

Issues a burst of long, high-entropy subdomain lookups under a controlled zone — the shape of data being smuggled out inside DNS queries. The data encoded in the labels is a fixed benchmark marker, not anything from this host.

Severity high how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1048.003	Exfiltration Over Unencrypted Non-C2 Protocol	Exfiltration	coverage statistics
T1071.004	DNS	Command and Control	coverage statistics
T1572	Protocol Tunneling	Command and Control	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other exfiltration tests

Other tests in the Exfiltration category.
Test	What it does	Severity
Upload to consumer cloud storage exfil_cloud_storage_upload	Attempts to upload a synthetic-PII canary to Dropbox, Google Drive, OneDrive, an anonymous file drop and a paste site, using deliberately invalid cred…	high
DNS-over-HTTPS resolver bypass exfil_doh_resolution	Resolves a known-bad test domain through public DNS-over-HTTPS resolvers instead of the host's configured resolver, to establish whether DNS filtering…	high
Outbound HTTP POST carrying synthetic PII exfil_http_post_pii	POSTs the synthetic-PII canary to a controlled endpoint over both HTTPS and plain HTTP, so content inspection can be told apart from destination filte…	high
Canary documents with synthetic sensitive data exfil_dlp_canary_documents	Writes documents whose content is what data-loss-prevention rules look for — Luhn-valid but unissued test card numbers, national-ID-shaped strings, AP…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.