# DNS Log Analysis (lab)

> Investigate a week of corporate DNS logs in which no single query is evidence of anything. Find a domain-generation-algorithm infection by combining two per-host measurements — NXDOMAIN rate and…

Canonical: https://codelivly.com/labs/dns-analysis

| | |
|---|---|
| Type | Investigation |
| Difficulty | Beginner |
| Points | 250 |
| Session length | 30 min |
| Completions | 1 |

Investigate a week of corporate DNS logs in which no single query is evidence of anything. Find a domain-generation-algorithm infection by combining two per-host measurements — NXDOMAIN rate and query-label entropy — that each point at a documented benign source when used alone.

## Objective

Learn that useful DNS detections are conjunctions: compute NXDOMAIN rate and Shannon entropy per host, understand with concrete counter-examples why neither measurement is usable alone, and identify the one DGA-infected host plus the single live command-and-control domain hiding among hundreds of failures.

## Tasks

1. Measure NXDOMAIN rate per host
2. Rule out the documented benign sources
3. Combine the two measurements
4. Find the one name that resolved
5. Establish timing and map to MITRE

## Related

- [All labs](https://codelivly.com/practice?type=lab)