SOP-32: DNS Exfiltration and Tunnelling Response

SOC analyst SOP for DNS-based data exfiltration and tunnelling detection. Covers high-frequency subdomain queries, long DNS labels, and tunnelling tools.