Potential DNS Tunneling or Encoded Data Transfer

How the attack works

An attacker first gains a foothold on a machine and wants to move data out without triggering standard network monitoring. Instead of uploading files directly, they encode the data (often in hex) and split it into chunks that look like subdomains, e.g. long strings of characters followed by a domain the attacker controls. The infected machine sends DNS queries, including TXT record lookups, for these encoded subdomains, and the attacker's DNS server decodes the responses on the other end. Because DNS traffic is rarely inspected closely and is almost always allowed out of a network, this channel bypasses many outbound content filters.

Netzilo detection

Why it matters

An organization can lose sensitive data — credentials, documents, or command-and-control instructions — through a channel that most security tools don't scrutinize, potentially without detection until the data is already gone.

What you can do

• →Log and review DNS query patterns, especially unusually long subdomains, high query volume to a single domain, and frequent TXT record lookups.
• →Restrict which internal hosts are allowed to make direct external DNS queries; force clients through an internal resolver you control and monitor.
• →Set alert thresholds for abnormal DNS query length, entropy, or frequency per host.
• →Investigate use of hex-encoding or dump utilities piped into network commands on endpoints, while accounting for legitimate diagnostic or binary-inspection use.

Known benign look-alikes

• Network administrators performing DNS diagnostics
• Security teams running authorised DNS audits
• Hex dump utilities used for legitimate binary file inspection

References

• https://attack.mitre.org/techniques/T1048/
• https://atlas.mitre.org/techniques/AML.T0024

Related threats