DNS exfiltration exploits the fact that DNS traffic is rarely blocked and rarely inspected at depth. Attackers encode stolen data into DNS query subdomains — a 63-character label limit per subdomain and up to 255 characters total per FQDN allows ~200 bytes per query, enough to slowly exfiltrate gigabytes when queries are sent at scale. Tools like dnscat2 create full bidirectional covert channels over DNS, while iodine tunnels IPv4 over DNS TXT records. Detection requires volume analytics, label-length statistics, and entropy scoring, not simple signature matching.
Key data sources: DnsEvents (Azure DNS Analytics / DNS connector), DeviceNetworkEvents (MDE DNS query telemetry), CommonSecurityLog (firewall/proxy DNS logs), ASimDnsActivityLogs (ASIM-normalized DNS schema).
☰ Table of Contents
01 — BACKGROUND
TECHNIQUE OVERVIEWDNS tunnelling exploits the universally permitted DNS protocol to create covert data channels that bypass firewalls, DLP, and proxy inspection. dnscat2 is the most common open-source tool — it encodes arbitrary data (shell commands, file bytes, C2 traffic) into DNS query/response pairs using TXT, MX, CNAME, and A record types. iodine specifically tunnels IPv4 packets over DNS TXT records, providing a full IP stack over DNS. Custom exfil scripts encode data as sequential long subdomain labels pointed at attacker-controlled authoritative nameservers, which decode and reassemble the stream.
| Field | Value |
|---|---|
| MITRE Techniques | T1048.003 — Exfiltration Over Alternative Protocol: Unencrypted T1071.004 — Application Layer Protocol: DNS |
| Kill-chain Phase | Exfiltration / Command & Control |
| Primary Log Source | DnsEvents, ASimDnsActivityLogs, DeviceNetworkEvents |
| Secondary Log Sources | CommonSecurityLog (Palo Alto / Cisco DNS syslog), AzureFirewallNetworkRule, DnsInventory |
| Known Tools | dnscat2, iodine, DNScat, NSDNS, dns2tcp, cobalt-strike DNS C2, custom base64 subdomain scripts |
| Default Severity | SEV2 on detection; escalates to SEV1 if data volume exceeds 1 MB or confirmed C2 tunnel |
| Key Metric | Label length >40 chars, query rate >100/min from single host, TXT record ratio >20% of total DNS from host, NXDOMAIN rate >30% |
DNS exfil is slow but undetected for months. The average dwell time before DNS tunnel detection is 47 days (SANS 2024). A host querying 500+ unique FQDNs per hour under a single second-level domain is almost certainly tunnelling — normal user endpoints query 5–20 unique domains per hour.
02 — IDENTIFICATION
2 INDICATORSDNS TXT records are the preferred exfil record type because they support arbitrary binary data up to 255 bytes per string. dnscat2 defaults to TXT queries. Legitimate applications generate very few TXT queries — SPF/DKIM lookups account for nearly all legitimate TXT traffic and originate from mail servers, not endpoints. An endpoint generating >20 TXT queries per minute to a single domain is a near-certain tunnel indicator. Long base64-encoded subdomain labels (40+ chars) are the signature of encoded data chunks — legitimate hostnames are human-readable and short.
- 1Run the KQL query below. Set time range to Last 1 hour for active investigation; extend to Last 7 days to establish baseline and identify slow-burn exfil.
- 2For each flagged host, examine the
Name(queried FQDN) field. Count the length of the leftmost label (subdomain before the first dot) — labels exceeding 40 characters with base64 character patterns ([A-Za-z0-9+/=]) indicate encoded data. - 3Identify the second-level domain (SLD) being queried — e.g.
a1b2c3def456.exfiltrate[.]com. Pivot to Threat Intelligence in Sentinel to check if this domain is a known dnscat2/DNS tunnel domain. - 4Cross-reference
ClientIPin DeviceNetworkEvents to identify the process making DNS requests —nslookup.exe,powershell.exe, or an unusual process name making DNS calls is highly suspicious. - 5Check if the authoritative nameserver for the target SLD resolves to a VPS/cloud provider (DigitalOcean, Linode, Vultr, Hetzner AS) — attacker-operated authoritative NS servers are the exfil receiving endpoint.
| Indicator | Meaning | Severity |
|---|---|---|
| >50 TXT queries/min from single host | Active dnscat2 or iodine tunnel — data being exfiltrated or C2 channel active | HIGH |
| Subdomain label length >40 chars | Base64/hex encoded data chunk — classic DNS exfil encoding pattern | HIGH |
| >200 unique subdomains to single SLD/hr | Sequential chunk transmission — reassembly at attacker nameserver indicates active exfil | HIGH |
| MX/NULL/CNAME query flood to single domain | dnscat2 multi-record-type tunnel — tool rotates record types to evade single-type filters | MEDIUM |
| DNS queries from non-browser/non-OS process | Malware or script making direct DNS calls — confirm via DeviceNetworkEvents InitiatingProcess | MEDIUM |
To confirm dnscat2 specifically: look for queries using sequential numeric prefixes on long encoded labels (e.g., 01.a1b2c3..., 02.a1b2c3...) — dnscat2 sequences chunks numerically. Also check if query sizes increase then reset cyclically — this is the session/stream boundary signature.
A high NXDOMAIN (Non-Existent Domain) rate from a single host indicates either DNS DGA (Domain Generation Algorithm) malware polling for the active C2 domain, or a misconfigured DNS tunnel where encoded query strings don't resolve. DGA malware generates hundreds of random-looking domain names per hour — only one will be registered by the attacker on any given day. The massive NXDOMAIN ratio (often >95%) is a distinctive DGA fingerprint. Separately, DNS C2 beaconing produces a periodic, low-rate DNS query pattern to a single domain at fixed intervals — the jitter-free regularity distinguishes it from human browsing.
- 1Run the NXDOMAIN ratio query below to identify hosts with >30% NXDOMAIN rate — set time range to Last 4 hours. Normal endpoints have <5% NXDOMAIN rate.
- 2For hosts with high NXDOMAIN rate, inspect the failing domain names for DGA characteristics: high character entropy, no vowels or consonant clusters, 8–20 character length, random-appearing TLD pattern.
- 3For C2 beacon detection, run the periodic query analysis — look for hosts making DNS requests to the same domain at suspiciously regular intervals (every 30s, 60s, 300s). Real browsing is irregular; C2 beacons have <5% jitter.
- 4Pivot identified suspicious domains to Sentinel → Threat Intelligence → TI Workbook and search against TAXII feed indicators. Also submit to VirusTotal / any-run for rapid classification.
| Indicator | Meaning | Severity |
|---|---|---|
| NXDOMAIN rate >30% from single host | DGA malware polling for active C2 — host is likely compromised and beaconing | HIGH |
| >100 NXDOMAIN/hr to distinct random-looking FQDNs | Active DGA generation — malware cycling through domains to find C2 | HIGH |
| Periodic DNS query to same domain (fixed interval) | DNS C2 beacon — regular heartbeat indicates implant checking for commands | HIGH |
| Low-TTL (1–5s) responses from unknown domain | Fast-flux DNS — attacker rotating IPs rapidly to evade blocklists | MEDIUM |
| DNS queries outside business hours from server | Off-hours C2 activity — malware beaconing when less likely to be noticed | MEDIUM |
03 — CONTAINMENT
DECISION + ACTIONS- 1DNS sinkhole: Add the exfil domain(s) to your DNS block list / sinkhole immediately — this cuts the exfil channel without alerting the attacker to the investigation (endpoint stays online but channel dies silently).
- 2Firewall block: Add the attacker-controlled authoritative NS IP and any resolved IPs to the network firewall deny list on port 53 UDP/TCP. Also block any backup C2 domains identified in the NXDOMAIN analysis.
- 3PCAP capture: Before full isolation, capture DNS traffic from the affected host for at minimum 10 minutes. This preserves evidence of the tunnel and may reveal the destination IP of the authoritative NS controlling the exfil.
- 4Endpoint isolation: Only isolate via MDE after PCAP capture. Isolation will cut the DNS channel anyway — PCAP first preserves the live evidence trail.
04 — ERADICATION
CLEANUP & RECOVERY- 1Identify and terminate tunnel process: From DeviceNetworkEvents attribution, identify the initiating process. Use MDE Live Response to confirm the process is running and collect the binary before terminating:
get <binary_path>→run antimalware-scan.exe. - 2Estimate data volume exfiltrated: Sum the total bytes in DNS query names over the tunnel timeframe — each character in a subdomain label is ~1 byte. DNS labels are max 63 bytes; queries max 255 bytes total. Calculate:
total_query_chars × 0.75(base64 decode ratio) = approximate raw bytes exfiltrated. Report this figure to the data owner. - 3Identify data type exfiltrated: If you can decode the base64 labels from captured DNS queries, do so to determine the content category (credentials, files, database records). This drives notification obligations.
- 4Re-image if dnscat2/iodine confirmed: These tools are typically delivered as implants with persistence mechanisms. Full OS re-image is recommended unless forensic memory analysis confirms no persistence (scheduled task, registry run key, service).
- 5DNS resolver hardening: Enable Response Policy Zones (RPZ) on internal DNS servers to block known tunnel domains. Consider deploying DNS Security Extensions (DNSSEC) validation and Cisco Umbrella / Cloudflare Gateway for outbound DNS filtering.
DNS exfil volume calculation is approximate — the actual bytes exfiltrated may be 2–3× higher if the attacker used compression before base64 encoding. Treat the calculated figure as a minimum for data loss reporting, not a ceiling.
05 — ESCALATION
THRESHOLDS & CONTACTS| Condition | Action | Severity |
|---|---|---|
| Confirmed DNS tunnel + process identified | Escalate to SOC Lead — initiate full IR playbook; notify data owner if PII/PHI scope suspected | SEV2 |
| Estimated exfil >1 MB or PII/PHI confirmed | Escalate to CISO + Legal — potential data breach notification obligation (GDPR 72h, NZ Privacy Act) | SEV1 |
| DGA malware confirmed (high NXDOMAIN + process) | Escalate to Threat Intel team — DGA seed/algorithm analysis for broader campaign scope | SEV2 |
| Multiple hosts tunnelling to same domain | Escalate immediately — indicates enterprise-wide compromise; initiate containment across all identified hosts | SEV1 |
| DNS exfil from server (not endpoint) | Escalate to SOC Lead — server compromise implies higher data sensitivity; may indicate post-exploitation lateral movement | SEV1 |
Always submit identified exfil domains and authoritative NS IPs to your MISP instance and threat intel sharing communities (ISACs). Other organisations may be targeted by the same infrastructure — coordinated takedown requests to the hosting provider are more effective than single-org reports.
CyberHawk Threat Intel
Built by Rudra Verma | Senior Cyber Security Architect & Researcher
"They can't exploit you if you are the Exploit."
Authorized security research & penetration testing only. Unauthorized use is illegal.