Data exfiltration through DNS

[4TheSmarts]

Hunt Type 🔥

{"Flames (Hypothesis-Driven)"=>"Based on assumptions about adversary behavior or specific activities."}

HEARTH Crafter

Cody Lunday

Hunt Idea / Hypothesis

An adversary is utilizing DNS tunneling to exfiltrate data through DNS port 53.

MITRE ATT&CK Tactic

Exfiltration Over Alternative Protocol

Implementation Notes

Attackers are interested in finding unmonitored communication channels to evade detection.

Search Tags

DNS #Tunneling #Exfiltration

Value and Impact

• DNS is commonly ignored or lightly monitored by enterprise defense strategies.
• DNS tunneling exploits may give attackers an accessible backchannel to exfiltrate stolen information.
• DNS provides a covert means of correspondence to bypass firewalls.

Knowledge Base

https://attack.mitre.org/techniques/T1048/ https://brightsec.com/blog/dns-tunneling/