Lesson 4.4: DNS and beaconing
Almost every connection starts with a DNS query, so the DNS log is one of the best places to see malware, even when traffic is encrypted. Three patterns stand out: beaconing (a machine asking for the same name at a regular interval), tunnelling (long, random-looking names carrying data out) and young domains (registered days ago). In the lab you analyse half an hour of Northwind's DNS log: measure the interval of a beacon, decode data being smuggled out through DNS queries, and match queries against a feed of newly registered domains.
17 min
You will learn to
- Explain why DNS logs matter for detection
- Measure beacon intervals
- Recognise DNS tunnelling
- Decode hex-encoded data in queries
- Use newly-registered-domain intelligence
Key terms
- Beaconing
- Malware contacting its C2 at regular intervals to ask for instructions.
- DNS tunnelling
- Carrying data inside DNS queries and answers, usually encoded in long subdomain names.
- Newly registered domain (NRD)
- A domain registered recently, often within the last 30 days.
- TXT record
- A DNS record holding free text, used legitimately for SPF, DKIM and verification, and abused for tunnelling.
← SQL injection · All lessons · Modes, IVs and authenticated encryption →