DNS, Tunnelling and Exfiltration

What is it?

DNS tunnelling hides data or command-and-control inside DNS queries and answers, abusing a protocol almost never blocked. A DGA (domain generation algorithm) produces many pseudo-random domains so the C2 rendezvous cannot be pre-blocked. Exfiltration is the theft of data out of the network — often a large outbound transfer to an unfamiliar destination. All three are read from flow and log behaviour, then tied back to the host that owns the connection.

Why it matters

DNS is the blind spot: it is allowed everywhere, so attackers use it when HTTPS is watched. Exfiltration is the moment the intrusion causes real loss. A Tier-2 analyst who can read these — and correlate them back to the responsible host and process (the Module 3 skill) — closes the loop from network signal to accountable machine.

Where you see it

DNS abuse appears in DNS query logs — unusually long or high-entropy subdomains, a flood of queries to one parent domain, or uncommon record types (TXT, NULL) used to carry data. Exfiltration appears in flow records as a large outbound byte count to a non-business destination. Both are correlated to a host through the endpoint telemetry from Module 3.

What normal looks like

Normal DNS is short, human-meaningful names, resolved in modest volume, mostly A and AAAA records. Normal outbound volume is bounded and goes to known services — backups to the backup target, sync to the cloud provider. Explainable destinations and explainable volume are the everyday.

What suspicious looks like

Suspicious DNS is long, high-entropy subdomains under one parent, a high query rate no application explains, and odd record types — the signature of tunnelling or a DGA. Suspicious exfiltration is a large, one-shot or steady outbound transfer to a destination nobody recognises, especially from a host or account with access to sensitive data.

How analysts investigate

For DNS: aggregate queries by parent domain and look for high volume, long/random subdomains and unusual record types. For exfiltration: sort outbound flows by bytes and inspect the largest to unfamiliar destinations. For both: correlate the connection back to the owning host and process, so the network finding names an accountable machine — closing the loop with Module 3.

Common beginner mistakes

Ignoring DNS because it is 'just name resolution' — it is a fully usable covert channel.
Flagging a large transfer without checking whether it is a known backup or sync to a legitimate destination.
Stopping at the network finding without correlating it back to the host and process that own the connection.

What you will be able to do

Recognise DNS tunnelling and DGA activity from query behaviour.
Detect exfiltration from outbound volume, and rule out a benign backup.
Correlate a network finding back to the host and process that own it.

When HTTPS is watched, attackers move to DNS — allowed everywhere and rarely inspected. And when the goal is theft, the network shows it as volume leaving. Both are read from behaviour, and both must end the same way: correlated to the host and process that own the connection, so a wire signal becomes an accountable machine.

Technique	What to look for
DNS tunnelling	Long, high-entropy subdomains; odd record types (TXT/NULL); high volume to one parent
DGA	Many random-looking domains, mostly failing to resolve, then one succeeds
Exfiltration	Large outbound bytes to an unfamiliar, non-business destination

Worked example — name resolution, or a channel?

DNS query log · host SRV-DB-04

k3n8f2q9x1.data.evil-domain.tld   TXT
p7m2a5z0w4.data.evil-domain.tld   TXT
... 4,000 more TXT queries to *.data.evil-domain.tld in 10 minutes

Thousands of DNS queries in minutes. Before reading on, decide: is this normal name resolution, and what is it really doing?

The answer: not name resolution — a tunnel. Normal DNS is a modest number of short, meaningful names, mostly A records. Here are thousands of long, high-entropy subdomains under one parent domain, all TXT records, in ten minutes. That is data being encoded into the query names and carried out over DNS. The next step is decisive: correlate these queries back to the process on SRV-DB-04 that is making them, so the network finding names an accountable host and the loop with the endpoint closes.

Recap

DNS is a full covert channel — long/random subdomains and odd record types signal tunnelling.
Exfiltration is large outbound volume — but always rule out the benign backup first.
Always correlate the network finding back to the owning host and process.