Threat Hunting Exercise: Analyzing Firewall DNS Tunnel Port53 Exfiltration Dataset
This hunt uses a simulated perimeter firewall and DNS log dataset (firewall_dns_tunnel_2022-10-14T151500.json) capturing T1048.003: Exfiltration Over Alternative Protocol (DNS Tunneling), where an attacker encodes stolen data as subdomain labels in outbound DNS queries to an attacker-controlled authoritative nameserver, abusing the near-universal allow-listing of port 53 traffic at the perimeter.
Step 1: Hypothesis Formation
Hypothesis: A host generates an abnormally high volume of DNS queries for long, high-entropy subdomains under a single second-level domain, with query sizes approaching the 253-character DNS name limit and query types (TXT, NULL, or repeated A records) inconsistent with normal browsing/resolution behavior - indicating DNS tunneling. Indicators:
- Query names with long (40+ character), high-Shannon-entropy subdomain labels under a single registered domain.
- Sustained query volume (hundreds to thousands per hour) to that domain from a single internal host, far exceeding typical DNS resolution patterns.
- Frequent use of
TXTorNULLrecord types, which carry more data payload per response than standardA/AAAAlookups. - The queried domain is newly registered or has no legitimate business/CDN/SaaS relationship with the organization.
Null Hypothesis: The host is running a legitimate CDN, threat-intelligence, or security-vendor agent that performs high-volume DNS-based reputation lookups (a known, documented pattern for some EDR/DNS-filtering agents). Invalidate by confirming the destination domain and process against the approved security-tooling inventory.
Rationale: DNS is almost universally permitted outbound without deep inspection, making it a resilient covert channel for both C2 and exfiltration; entropy- and volume-based detection catches the technique independent of the specific encoding scheme used.
Step 2: Data Sources and Scope
- Sources: Perimeter firewall logs (port 53); DNS resolver/recursive server query logs; endpoint process telemetry for the querying process.
- Scope: ~2022-10-14T15:15:00-16:45:00 UTC; Host: WKS-FIN-071 (10.35.7.19); Queried domain:
up7f2.exfil-ns.net. - SIEM Queries (Splunk/ELK):
index=dns query_type IN (TXT,NULL) | stats count, avg(len(query_name)) as avg_len by src_ip, query_domain | where count>300- Entropy flag:
index=dns | eval entropy=shannon_entropy(query_name) | where entropy>4.0 - Domain reputation:
| lookup threat_intel_domain query_domain OUTPUT reputation_score, first_seen_date
Step 3: Key Findings
Parsed events (5 shown) confirm WKS-FIN-071 issued over 6,300 high-entropy TXT-record DNS queries to a domain registered 11 days prior, consistent with an active DNS tunneling exfiltration channel.
| Timestamp (UTC) | Host | Event | Detail | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-10-14 15:15:03 | WKS-FIN-071 | Firewall (allow, UDP/53) | Query for 4a1f9c8e2b7d.up7f2.exfil-ns.net type TXT | Entropy IOC: the 12-character hex-style subdomain label has Shannon entropy of 3.9, far above typical human-readable hostnames. |
| 2022-10-14 15:15:03 - 16:44:51 | WKS-FIN-071 | Firewall (aggregate) | 6,312 TXT queries to *.up7f2.exfil-ns.net, averaging one query every 0.86 seconds | Volume+Cadence IOC: this sustained, machine-paced query rate over 90 minutes is inconsistent with any legitimate browsing or resolution workload. |
| 2022-10-14 15:16:40 | WKS-FIN-071 | (EDR process check) | Process dnscat2.exe (unsigned) actively issuing DNS queries via raw socket, bypassing the system resolver | Tooling IOC: dnscat2-family behavior - direct raw-socket DNS query generation - is a well-documented DNS-tunneling toolkit signature. |
| - | - | (domain reputation check) | exfil-ns.net registered 11 days prior via a privacy-proxy registrar, authoritative nameserver hosted on a bulletproof-hosting ASN | Corroborates the domain as attacker-controlled infrastructure with no legitimate business relationship. |
| 2022-10-14 15:14:50 | WKS-FIN-071 | (file access correlation) | EDR shows the same process reading files from C:\Users\r.tanaka\Documents\Contracts\ in the minute preceding the query burst | Exfil-Source IOC: file access from a sensitive document directory immediately correlates with the start of the DNS query burst, indicating the tunneled data originates there. |
Validation:
- Timeline: sensitive-file access immediately followed by a sustained 90-minute high-volume, high-entropy DNS query burst to a newly-registered domain - matches the known behavioral profile of DNS-tunnel exfiltration tooling.
- False Positives: no approved security-vendor or CDN agent accounts for this domain or query pattern; the querying process is unsigned and uses raw sockets atypical of the system DNS resolver.
- Correlation: entropy, volume/cadence, tool identification, domain reputation, and correlated sensitive-file access together confirm active data exfiltration over a DNS tunnel.
Step 4: Recommendations & Next Steps
- Immediate Response: Isolate WKS-FIN-071 immediately; sinkhole/block
exfil-ns.netat the recursive resolver and perimeter firewall; identify the full scope of data accessed from the Contracts directory during the exfiltration window; preserve the endpoint for forensic analysis of the tunneling tool. - Detection: Sigma-style rule:
title: DNS Tunnel - High-Entropy High-Volume TXT Queries→selection: query_type=TXT AND query_name_entropy>3.5 AND query_count_per_domain_10m>100→condition: selection. - Pro Tip: Alert on any single internal host generating more than 100 DNS queries per 10-minute window to a single second-level domain outside the organization's top-N most-queried domains - legitimate resolution patterns are overwhelmingly spread across many domains, so concentrated volume to one domain is a low-effort, high-fidelity DNS-tunnel signal even without entropy analysis.
Hypothesis confirmed - an attacker used a DNS tunneling tool to exfiltrate data read from a sensitive contracts directory, encoding it across more than 6,300 high-entropy TXT-record queries to a newly-registered attacker-controlled domain over 90 minutes!