SOP-32: DNS Exfiltration & Tunnelling Detection

Detection and response procedures for DNS-based data exfiltration and DNS tunnelling using dnscat2, iodine, and similar tools. Covers high-volume TXT query analysis, long subdomain label detection, NXDOMAIN spike patterns, and C2 beacon periodicity via DNS.