An analyst notices that traffic from the corporate network to a newly registered domain spikes every night at 2 AM in 512-byte intervals lasting 30 minutes. Zeek logs show the connection uses port 53. What is the most likely threat and best immediate analytical step?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — suspect DNS tunneling for C2 or exfiltration, then extract and decode the DNS query/response payloads to look for encoded data in subdomains or TXT records. The nightly 512-byte port 53 spikes to a newly registered domain are a textbook beaconing pattern.
Full Explanation
The correct answer is to suspect DNS tunneling for C2 or exfiltration and extract and decode DNS query/response payloads to identify encoded data in subdomains or TXT records. Regular 512-byte DNS traffic to a newly registered domain at consistent intervals is a textbook DNS tunneling indicator: beaconing cadence, unusual query sizes, and a new domain. Decoding subdomain labels or TXT records reveals whether data is being smuggled. The normal NTP option is wrong because NTP uses UDP port 123, not port 53, and does not exhibit this pattern. The port scanning option is wrong because port scanning would show SYN packets across many ports, not recurring single-port traffic. The misconfigured DHCP option is wrong because DHCP operates on ports 67/68 and DHCP issues would not produce consistent 2 AM outbound DNS traffic.