This rule detects potential DNS tunneling or DNS-based command-and-control by identifying a client that issues many unique, unusually long DNS query names to the same registered domain within a five-minute window. It analyzes DNS telemetry from network sources (network_traffic.dns and zeek.dns, with support notes for legacy packet-based DNS events) and derives per-client metrics such as the length of subdomains, the number of distinct query names, and sample values. The detector computes subdomain_length as the difference between the full query name and the registered domain, filtering on long subdomains (>= 50 characters) and excluding PTR records and arpa suffixes. It aggregates by time window, client, and apex domain, requiring a minimum activity threshold (at least 25 queries and 15 distinct names) before triggering. Output fields include time window, client IP, domain, counts, ratios, and samples to aid investigation, plus destination IP values and metadata about the investigator observers. The rule maps to MITRE ATT&CK techniques for DNS-based application-layer C2 (T1071.004) and protocol tunneling (T1572), as well as Exfiltration over non-C2 protocols (T1048.003). It emphasizes that DNS-over-HTTPS/DoT traffic may not be visible to packet capture unless decrypted telemetry is available. The rule includes false-positive considerations (e.g., long hostnames from CDN/telemetry, recursive resolvers, NAT gateways, and shared resolver infrastructure) and recommended response steps such as blocking the apex domain at resolvers, isolating the source host, and temporarily blocking the apex domain while scoping additional hosts. Overall, it provides a behavior-based, data-driven approach to identify suspicious DNS tunneling without relying on threat intel feeds or ML models."