B'ad Samurai 🐐<p>Since DNS is on 🔥 today I should note if you're a Splunk shop, the DNS data model in Enterprise Security does not include the field for TXT record values, you need to add that manually.</p><p>Then you can do high-fidelity detections such as length and base64 with conversions looking for code.</p><p><a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>dns</span></a> <a href="https://infosec.exchange/tags/splunk" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>splunk</span></a> <a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>blueteam</span></a></p>