A threat hunter suspects an attacker is using DNS tunneling for data exfiltration. Which SIEM query characteristic most effectively detects this technique?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because DNS tunneling encodes data in DNS query subdomains, resulting in long, high-entropy hostname strings and unusually high query rates to a specific authoritative domain. B is wrong because NXDOMAIN responses indicate failed resolutions, which is common for domain generation algorithm (DGA) detection but not the definitive DNS tunneling indicator.
Full explanation below image
Full Explanation
A is correct because DNS tunneling encodes data in DNS query subdomains, resulting in long, high-entropy hostname strings and unusually high query rates to a specific authoritative domain. B is wrong because NXDOMAIN responses indicate failed resolutions, which is common for domain generation algorithm (DGA) detection but not the definitive DNS tunneling indicator. C is wrong because DNS using UDP is normal; DNS tunneling can use either UDP or TCP. D is wrong because DNS queries from DMZ servers to port 53 is normal recursive DNS behavior.