Data Exfiltration via DNS Tunneling

---

DNS exfiltration abuses the Domain Name System, a protocol normally allowed through networks, to smuggle bytes encoded inside DNS queries/responses so firewalls and web proxies don’t notice. Because DNS is typically allowed and often unfiltered or forwarded to public resolvers, it’s attractive for covert channels.

DNS Tunneling

DNS (Domain Name System) translates human-friendly domain names (e.g., example.com) into IP addresses and provides other record types (A, AAAA, TXT, MX, CNAME, etc.). Key points:

• DNS queries are ubiquitous: almost every host performs DNS lookups.
• DNS is normally allowed through firewalls and gateways, making it an attractive covert channel.
• DNS uses UDP (mostly) on port 53 for queries and responses; TCP is used for zone transfers or large responses.

Why attackers use DNS for exfiltration:

• Always-on service: DNS lookups are routine and often allowed outbound.
• High cover: queries look like normal requests unless inspected closely.
• Flexible payload: data can be encoded into the subdomain labels or TXT responses.

Indicators of attack 

When analyzing DNS traffic for possible indicators of data exfiltration, we should look for:

• Many DNS queries are sent to a single external domain, especially with very high counts compared to the baseline.
• Long subdomain labels or unusually long full query names (> 60–100 characters).
• High entropy or Base32/Base64-like patterns in the query name (lots of mixed case letters, digits, -, = signs for base64).
• Rare record types (TXT, NULL) or many large TXT responses.
• Unusual response behavior: frequent NXDOMAIN (if attacker uses exfil-by-query without answering), or TCP/large UDP fragments for DNS.
• Queries at regular intervals (beaconing behaviour).

Detecting with Wireshark

• Filter DNS queries with no responses: dns.flags.response == 0
• Find long queries (suspicious subdomain lengths)
  • filter: dns && frame.len > 70
• Find suspicious looking domain names
  • e.g., alfb4un4io5gb6waoifasflkh.domainname.com
• Filter for suspicious domain name: dns && dns.qry.name contains "domainname.com"

Investigating with Splunk

• Look for suspicious looking domains with a huge query count from multiple hosts or from one host (suspicious if the domain is untrusted)
• Look at single hosts generating far more DNS requests than normal
• Look for long query names (subdomain encoding)
  • e.g., sourcetype=DNS_logs | where len(query) > 30