An analyst notices that traffic from the corporate network to a newly registered domain spikes every night at 2 AM in 512-byte intervals lasting 30 minutes. Zeek logs show the connection uses port 53. What is the most likely threat and best immediate analytical step?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because regular 512-byte DNS traffic to a newly registered domain at consistent intervals is a textbook DNS tunneling indicator (beaconing cadence, unusual query sizes, new domain). Decoding subdomain labels or TXT records will reveal whether data is being smuggled.
Full explanation below image
Full Explanation
B is correct because regular 512-byte DNS traffic to a newly registered domain at consistent intervals is a textbook DNS tunneling indicator (beaconing cadence, unusual query sizes, new domain). Decoding subdomain labels or TXT records will reveal whether data is being smuggled. A is wrong because NTP uses UDP port 123, not port 53, and does not exhibit this pattern. C is wrong because port scanning would show SYN packets across many ports, not recurring single-port traffic. D is wrong because DHCP operates on ports 67/68 and DHCP issues would not produce consistent 2 AM outbound DNS traffic.