What is exfiltration over DNS?¶
The practical answer¶
Exfiltration over DNS uses domain-name queries or responses to carry data out of an environment.
The key evidential caution¶
The dangerous assumption is that long or unusual DNS queries automatically prove data exfiltration.
They do not.
Legitimate services may generate complex subdomains for tracking, cloud operation, security or content delivery.
Possible indicators include:
Key points¶
- encoded subdomains
- many unique queries
- unusual query length
- regular transfer-like patterns
- queries from an unexpected process
- high volume to one domain
- content that can be decoded into data
Evidence to preserve¶
Investigators should preserve:
Key points¶
- full queries and responses
- source device and process
- timestamps
- resolver used
- destination domain
- registration and hosting context
- related endpoint activity
- decoded content where specialist analysis supports it
A DNS query may show an attempt to transmit data.
It does not prove the authoritative server received, decoded or retained it.
Where queries are cached or blocked, the data may not leave the local resolver.
Specialist interpretation may be required.
Where the data appears encoded across many queries, preserve ordering and timing because reconstruction may depend on sequence. Missing queries, caching and resolver behaviour may make the recovered content incomplete. That limitation should be stated rather than assuming the full dataset left the environment.
Compare the suspected data volume with the capacity of the DNS channel and the period available. An implausibly large claimed transfer should not be inferred from a small number of short queries.
This helps test whether the claimed transfer is technically plausible.
Operational takeaway¶
Correlate unusual DNS content with the responsible process, resolver path and recoverable data before describing it as successful exfiltration.