title: DNS Query With An Unusually Long Label
id: 9a907a27-eb03-45e6-b3b4-68f3180c0080
status: experimental
description: |
  Detects DNS queries containing a single label of fifty characters or more. Data carried over
  DNS has to be packed into labels, and the practical limit of sixty-three characters per label
  is where tunnelling tools sit. Legitimate names very rarely approach it. This is a per-query
  rule; the stronger signal (many unique subdomains under one parent) needs an aggregation in
  your SIEM and is described on the page this pack ships with.
references:
  - https://attack.mitre.org/techniques/T1071/004/
  - https://attack.mitre.org/techniques/T1048/003/
  - https://www.rfc-editor.org/rfc/rfc1035
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.command-and-control
  - attack.t1071.004
  - attack.exfiltration
  - attack.t1048.003
logsource:
  category: dns
detection:
  selection:
    query|re: '(^|\.)[A-Za-z0-9_-]{50,}\.'
  filter_optional_known:
    query|endswith:
      - '.in-addr.arpa'
      - '.ip6.arpa'
      - '.sophosxl.net'
      - '.mcafee.com'
      - '.e5.sk'
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Security products that carry reputation lookups in DNS labels (several antivirus vendors do). The filter list starts with the common ones; extend it from a week of your own resolver logs before alerting on this.
  - DKIM and other long TXT lookups under _domainkey.
level: medium