## Use Case 5: DNS Tunneling (Hard)

**Scenario**: A firewall blocks all traffic (HTTP, SSH, FTP) except for DNS (Port 53). Attackers know DNS must be open for the internet to work. They encode stolen data inside DNS queries to sneak it past the firewall. This is **DNS Tunneling**.

### The Logic
DNS is meant for address lookups (Phonebook). It is not meant for data transfer. Tunneling creates data that looks essentially different from normal lookups.

### 1. The Data Sources
*   **Source**: DNS Server Logs, Firewall Logs (Port 53), or Passive DNS sensors (Zeek).
*   **Key Fields**:
    *   `Query`: The domain being requested (`xyz.example.com`).
    *   `Query Type`: A, TXT, CNAME, NULL, MX.
    *   `Response Size`: Size of the answer.

### 2. The Pattern
*   **Long Subdomains**:
    *   Normal: `www.google.com`
    *   Tunneling: `base64_packet1_part2_secret_data.attacker.com` -> `cGFzc3dvcmQxMjMK.attacker.com`.
    *   The attacker controls the `attacker.com` authoritative nameserver, which logs the incoming query (and thus receives the stolen data).
*   **High Volume**:
    *   A normal user makes ~1000 DNS queries a day.
    *   Tunneling requires thousands of queries to transfer a small file because each query can only hold a few bytes of data.
*   **Rare Record Types**:
    *   Using `TXT` or `NULL` records to pack more data into the response (C2 commands coming back).

### 3. The SIEM Rule (Pseudocode)
```sql
Alert IF:
    Length(DNS_Query) > 180 characters
    OR
    Count(DNS_Queries) to Same_Root_Domain > 1000 in 1 hour
    OR
    Unusual_Record_Type (TXT, NULL) with High Entropy (Randomness)
```

### 4. Investigation Steps (The Playbook)
1.  **Decode the Subdomain**:
    *   Copy the subdomain string. Try Base64 or Hex decoding it.
    *   If it decodes to "Confidential_Q3_Report.pdf", you have confirmed data exfiltration.
2.  **Check the Domain Reputation**:
    *   Is the root domain (`attacker.com`) known?
    *   Does it resolve to a legitimate site?
3.  **Identify the Endpoint**:
    *   Which machine is making the requests? Isolate it.
    *   Check for tunneling tools like `dnscat2` or `iodine` running in the process list.

### 5. False Positives
*   **CDN / Anti-Virus Lookups**: McAfee/Sophos use DNS to check file hashes. These queries look like `long_random_hash.sophosxl.net`. This is legitimate.
*   **Content Delivery Networks (Akamai)**: Often use long, complex subdomains.

### 6. Why it's "Hard"
Distinguishing between a legitimate detailed DNS lookup (like an AV signature check) and a malicious tunnel requires entropy analysis (measuring the randomness of the string), which simple rule logic struggles with. It usually requires Machine Learning or statistical baselining.