DNS exfiltration is the quiet misuse of name lookups to carry stolen information out of a network past ordinary controls.
The lookups are a normal sounding channel, which is why volume, length, and destination deserve attention rather than a how to guide.
How it works
A host that should rarely ask about strange names may instead generate many unusual queries whose purpose is to move data outward.
The defender's clue is the pattern of queries, not a recipe for hiding information inside them.
Response is to restrict which resolvers hosts may use, alert on abnormal query behavior, and investigate the host that is asking.
Blocking the entire name system would break legitimate work, so the control has to be selective and owned.
Concrete examples
- A workstation that never talked to external resolvers suddenly issues a long run of queries for names the business does not use.
- A server allowed to resolve only through an internal resolver is found asking a public resolver directly.
- An alert on unusually long names leads to a host that also shows a large read of a sensitive file share.
Protective measures
- Require managed hosts to use resolvers you control, and alert when a host bypasses them.
- Watch for unusual query volume, unusual name length, and destinations your business does not recognize.
- Investigate the host behind the queries before you treat the resolver log as the whole incident.
- Do not publish internal examples of how data was hidden in names, even in training slides.