An analyst reviewing Zeek DNS logs finds unusually long DNS query names (200+ characters) being sent to an external nameserver for a domain registered two days ago. What technique does this MOST likely indicate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because DNS tunneling encodes data in the subdomain portion of DNS queries, resulting in abnormally long query strings. Newly registered domains are a common indicator of attacker infrastructure.
Full explanation below image
Full Explanation
A is correct because DNS tunneling encodes data in the subdomain portion of DNS queries, resulting in abnormally long query strings. Newly registered domains are a common indicator of attacker infrastructure. B is wrong because DNS load balancing uses normal-length queries to known established DNS servers. C is wrong because DoH traffic appears as HTTPS on port 443, not as DNS queries. D is wrong because split-horizon DNS involves returning different responses to different clients, not abnormally long queries.