DNS logs in the SIEM show an internal host sending many DNS queries with long, encoded subdomains to an external domain. The queries predominantly use TXT records and occur during off- business…

Question

Options

• AMonitoring DNS cache poisoning attempts
• BDetecting rogue DNS servers within the internal network
• CIdentifying DNS tunneling for data exfiltration
• DValidating DNS records for legitimate business operations

• A
  5% (3)
• B
  8% (5)
• C
  67% (40)
• D
  20% (12)

Explanation

The described pattern is highly consistent with DNS tunneling used for command-and-control or data exfiltration. Long, encoded subdomains are commonly used to embed data into DNS queries because DNS labels can carry arbitrary text that can be base32/base64/hex encoded. TXT records are frequently abused in tunneling because they can return larger payloads and are flexible for exchanging data between malware and an external resolver or authoritative DNS infrastructure controlled by an attacker. The fact that this occurs off-hours and targets a newly registered domain with no business relationship increases suspicion and reduces the likelihood of legitimate use. DNS cache poisoning attempts would typically show anomalies in resolver behavior, unexpected DNS responses, or mismatched records, not a high volume of encoded outbound queries from a single internal host. Rogue DNS servers would present as internal hosts acting as resolvers or responding to many DNS queries, not sending encoded TXT queries outward. Legitimate record validation might involve standard query types (A/AAAA/CNAME) and normal domain names, not long encoded subdomains. For SOC triage, the next steps would include identifying the originating process/host, blocking the domain, capturing related network flows, and scoping for other hosts with similar DNS

No community discussion yet for this question.