npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- When conducting security assessments that involve performing dns tunneling detection
Detects DNS tunneling by calculating Shannon entropy of query names, analyzing lengths and TXT payloads, and checking subdomain cardinality with scapy packet analysis. For security ops and data exfiltration hunts.
Detects DNS tunneling attacks by calculating Shannon entropy of query names, analyzing lengths and TXT payloads, and identifying high subdomain cardinality using scapy packet capture in Python. Useful for threat hunting in data exfiltration scenarios.
Detects DNS tunneling data exfiltration by analyzing query entropy, subdomain length, volume, TXT record abuse, and response sizes via passive DNS monitoring. For security incident response and threat hunting.
Share bugs, ideas, or general feedback.
Analyze DNS traffic for indicators of DNS tunneling using entropy analysis and statistical methods on query name characteristics.
import math
from collections import Counter
def shannon_entropy(data):
if not data:
return 0
counter = Counter(data)
length = len(data)
return -sum((c/length) * math.log2(c/length) for c in counter.values())
# Legitimate domain: low entropy (~3.0-3.5)
print(shannon_entropy("www.google.com"))
# DNS tunnel: high entropy (~4.0-5.0)
print(shannon_entropy("aGVsbG8gd29ybGQ.tunnel.example.com"))
Key detection indicators:
from scapy.all import rdpcap, DNS, DNSQR
packets = rdpcap("dns_traffic.pcap")
for pkt in packets:
if pkt.haslayer(DNSQR):
query = pkt[DNSQR].qname.decode()
entropy = shannon_entropy(query)
if entropy > 4.0:
print(f"Suspicious: {query} (entropy={entropy:.2f})")