A SOC analyst is reviewing logs and notices that a DNS query for 'abcdefghijklmnopqrstuvwxyz1234567890.malicious-domain.com' returned an A record. Combined with high query frequency, what attack is most likely occurring?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — DNS tunneling is what you're seeing when a long, random-looking subdomain gets an address record and query frequency is high. The attacker hides data in the subdomain string and uses the DNS answer to carry commands or exfiltrated data back out.
Full Explanation
The DNS tunneling option is correct because DNS tunneling encodes data in DNS subdomain strings (which can be long and appear random); the authoritative server for the domain decodes the query data and encodes responses in address, TXT, and CNAME records, creating a bidirectional covert channel through DNS. The long subdomain and high query frequency fit that pattern. The DNS amplification DDoS attack using the malicious domain as the reflector is wrong because DNS amplification uses legitimate DNS resolvers as reflectors to flood a victim; it does not involve long encoded subdomains from an internal host. The Kaminsky DNS cache poisoning attack targeting the enterprise resolver is wrong because Kaminsky attacks target DNS resolver caches with forged responses; they do not involve long subdomain strings in outbound queries. The BGP route injection using DNS as a side channel is wrong because BGP is a routing protocol; DNS queries do not affect BGP routing.