A threat hunter suspects an attacker is using DNS tunneling for data exfiltration. Which SIEM query characteristic most effectively detects this technique?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you want to hunt for DNS records with unusually long hostnames or high-entropy subdomains and high query frequency to a single domain. That's the tell because DNS tunneling stuffs data into those subdomain labels and fires lots of queries at one authoritative domain.
Full Explanation
The effective query characteristic is searching for DNS records with unusually long hostnames or high-entropy subdomains with high query frequency to a single domain. DNS tunneling encodes data in DNS query subdomains, resulting in long, high-entropy hostname strings and unusually high query rates to a specific authoritative domain. Queries returning NXDOMAIN responses are wrong because NXDOMAIN responses indicate failed resolutions, which is common for domain generation algorithm detection but not the definitive DNS tunneling indicator. Queries using UDP instead of TCP are wrong because DNS using UDP is normal; DNS tunneling can use either UDP or TCP. Queries to port 53 from servers in the DMZ are wrong because DNS queries from DMZ servers to port 53 is normal recursive DNS behavior.