DNS tunneling

As explained in Cyber Threat Hunting

DNS tunneling is a technique for carrying commands or data through encoded DNS queries and responses, often to bypass network controls or support covert communication.

DNS tunneling uses DNS for communication rather than ordinary name resolution. Because UDP port 53 is often open, an internal host can carry data through DNS when standard web ports are restricted. The technique can support web access through an egress filter, but it can also provide an out-of-band channel for command-and-control or data exfiltration. section 9.1

Figure 9.1 DNS tunneling infrastructure

A tunneling setup links an internal host to an external system through DNS traffic, illustrating why allowed DNS resolution can become an alternate communication path. section 9.1

Hunt for tunneling by starting with DNS events that preserve queries, record types, and response details. Zeek can capture and summarize DNS requests and responses, providing fields such as query names, query types, and response codes for investigation. section 9.1

A supervised detection workflow separates regular DNS from suspected tunneling:

• Acquire labeled DNS data and define normal and tunneled classes; labels provide the ground truth a model learns to predict. section 9.2
• Keep training features aligned with production features, use recent relevant data, and seek balanced labeled classes. section 9.2.1
• Retain tool-level classes when useful: dns2tcp, dnscapy, iodine, and tuns can have different payload encodings, response sizes, query types, duplication, and throttling. section 9.2.1
• Review non-normal model classifications as leads, then inspect recurring domains, query types, and abnormal query content. section 9.3.6

Investigating microsofts.info

A Random Forest model mapped 3,171 DNS events under microsofts.info to tunneling classes. The events included TXT-record requests and abnormal query content; 63 events for the same domain were mapped as normal. A Whois lookup showed the domain was not owned by Microsoft, making the classification pattern a useful investigation clue rather than proof of a specific tunneling tool. section 9.3.6

How Cyber Threat Hunting covers it

How deep it goes

Defines the channel and develops a supervised workflow from labeled data through investigation, without identifying a specific tunneling tool.

Examples

Uses Zeek DNS events, a labeled domain-name dataset, tool-specific classes, and microsofts.info TXT requests.

What it assumes

Introduces DNS records and supervised labels, while assuming access to DNS events and appropriately labeled training data.

What you can do after

Diagnose/debug with it by prioritizing non-normal DNS classifications and reviewing associated domains and query behavior.

How it connects

Connects DNS tunneling with DNS records, egress filtering, command-and-control, data exfiltration, Zeek, and supervised machine learning.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

• domain name systemuses · The Domain Name System is a distributed, hierarchical naming system that resolves domain names to IP addresses and other network resource records.
• UDPuses · UDP (User Datagram Protocol) is a connectionless transport-layer protocol that sends datagrams without guaranteeing delivery, ordering, or duplicate suppression.
• supervised learningaddressed by · Supervised learning is a machine-learning approach that learns to map inputs to target outputs from examples paired with known labels or values.
• random forestmeasured by · A random forest is an ensemble model that combines predictions from multiple decision trees built with randomized data samples, feature selections, or both.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.