At an agency, malware traffic is wrapped inside DNS, and a detection rule that looks for the malware's own port stays quiet. Which evasion technique is in use?
Select an answer to reveal the explanation.
Short Explanation
Smuggling a parcel inside a mail sack gets it past a guard who only watches the freight door. You wrapped malware traffic inside DNS, so a rule for the malware's own port stays quiet, and that is tunneling. The trap is a proxy that only changes the client address, a stolen password, or a full disk.
Full Explanation
Tunneling carries one protocol inside another so a rule written for the inner port never sees that port. Wrapping the malware inside DNS is Tunneling, wrapping the malware traffic inside DNS so a rule for the malware port stays quiet. A proxy that rewrites the client address while leaving the malware protocol visible in the clear would change who appears to connect, and the malware's own protocol would still be there for a port rule to see. A stolen password, a reused credential that does not wrap one protocol inside DNS queries, is credential theft and does not hide a port inside DNS. A full disk on the sensor, a storage failure that does not wrap malware traffic inside DNS, can drop logs and does not perform this wrapping. The quiet port rule is explained by the wrapper: the malware port never shows up as its own transport port inside the DNS session. Exam caveat: a proxy can hide the original client, but this stem's quiet port rule comes from the DNS wrapper, which is the tunnel. Operational check: review the DNS queries for content that is not a normal lookup, and confirm no separate flow shows the malware's own port.