An analyst captures a Zeek DNS log entry showing extremely long subdomain labels: '6f626a65637476616c7565.aabbccdd1122.exfil-domain.com'. What does this indicate and what is the recommended analytical step?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because hex-encoded labels in DNS subdomains are a classic DNS exfiltration pattern — data is encoded in subdomain labels and sent as DNS queries to attacker-controlled resolvers. Decoding the hex reveals the data being exfiltrated.
Full explanation below image
Full Explanation
B is correct because hex-encoded labels in DNS subdomains are a classic DNS exfiltration pattern — data is encoded in subdomain labels and sent as DNS queries to attacker-controlled resolvers. Decoding the hex reveals the data being exfiltrated. Correlating multiple queries reconstructs the full data stream. A is wrong because CDN CNAMEs use descriptive labels, not long hex strings. C is wrong because DNS zone transfers use AXFR query types, not encoded subdomain labels. D is wrong because DKIM records are TXT records in the _domainkey subdomain, not hex-encoded query labels.