DNS Exfiltration — Agent Resolver Spawn With Encoded Query Name After Secret Staging
This detects the final step of a technique where an AI coding agent's shell access is hijacked to sneak stolen data out of a network. Instead of sending secrets over the network directly, the attacker encodes them into a DNS hostname lookup, which often slips past network controls that only watch for normal outbound traffic.
How the attack works
An AI agent (like Claude Code) with shell access is manipulated into first reading credential material or other secrets, then encoding that data (base64, base32, or hex), and finally running a DNS lookup command (dig, nslookup, host, resolvectl, or similar) where the hostname being looked up contains the encoded data instead of a real domain. All of this happens in the same command session within a short window, showing a deliberate chain rather than coincidence. The DNS server that receives the lookup, often controlled by the attacker, can log or reconstruct the smuggled data from the query name.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9f3c1d7a-4b62-4e58-9a1c-0d6f2b8e5714
- Severity
- High
Why it matters
An organization can lose credentials, API keys, or other sensitive data through a channel that many security tools don't inspect closely, because it looks like routine DNS traffic rather than a file upload or network connection.
What you can do
- →Restrict what shell commands an AI agent can execute, especially access to credential files and DNS utilities.
- →Log and review DNS query names for unusually long, encoded-looking labels, especially from processes tied to automated agents.
- →Watch for command sessions where a credential file is read, data is piped through an encoder, and a DNS lookup follows shortly after.
- →Treat this as one link in a longer attack chain: it flags a suspicious DNS lookup pattern, not proof that data was successfully exfiltrated or that the initial compromise is understood.
Known benign look-alikes
- DNS blocklist / reputation lookups that hash the subject into the query label (Spamhaus DBL hashblock, URIBL, SURBL) run from a shell in the same session as a base64/cut pipeline — the hex or base64 label plus the encoding stage can satisfy the corroboration bar.
- ACME dns-01 automation and DNS-provider scripts that read an API token from .env / .aws/credentials to publish a challenge and then poll the record with dig; the token read is genuine secret staging and the challenge label is long.
- Security engineers and red teams exercising DNS-exfiltration tooling (dnscat2, dnsteal, iodine, dns2tcp) or CTF/lab exercises on the developer's own machine.
- Debug or CI helper scripts that base64 a config blob and, within the same 5-minute window and process session, run dig/nslookup connectivity checks against long generated hostnames (ephemeral preview environments, per-build review-app DNS names).
- Service-discovery tooling that queries SRV/TXT names built from many stacked labels, executed alongside a credential-reading step for the same service.