DNS Exfiltration and Tunnelling

How the attack works

An attacker on a compromised host encodes stolen data into DNS queries, often as TXT-record lookups or long subdomain strings, and sends them to a nameserver they control. Because DNS is a core, generally trusted protocol, these queries often pass through firewalls and proxies unnoticed. Some attackers use dedicated DNS tunnelling tools, while others use DNS-over-HTTPS to route lookups directly to an external resolver, bypassing the local DNS server that a defender might be monitoring. The attacker's nameserver decodes the incoming queries to reconstruct the exfiltrated data.

Netzilo detection

Why it matters

An organisation can lose sensitive data through a channel that standard network monitoring often ignores, and may not detect the exfiltration because DNS traffic volume and structure are rarely scrutinized as closely as web or file-transfer traffic.

What you can do

• →Log and review DNS query content, not just query volume, especially TXT-record lookups and unusually long subdomains.
• →Restrict or monitor use of DNS-over-HTTPS on managed devices so lookups still pass through your visible DNS infrastructure.
• →Alert on internal hosts resolving directly against external nameservers instead of your designated internal resolvers.
• →Treat repeated DNS diagnostic activity from unexpected hosts as worth investigating rather than assuming it's benign administration.

Known benign look-alikes

• Network administrators running DNS diagnostics against a specific nameserver
• Applications that deliberately use DNS-over-HTTPS for privacy
• Service-discovery libraries performing SRV/TXT lookups as designed
• Certificate validation tooling querying TXT records for ACME dns-01 challenges

References

• https://attack.mitre.org/techniques/T1048/
• https://attack.mitre.org/techniques/T1071/004/

Related threats