Lab 3.3 — Suspicious DNS

Lab Overview

The Scenario

The SOC received an intelligence alert: "Threat actors associated with Operation Wire Tap are known to use DNS-based exfiltration and C2 channels. Their infrastructure includes recently registered domains with randomized subdomain patterns. DNS query lengths frequently exceed 60 characters."

Your task is to investigate all DNS-related alerts in the pre-loaded Suricata data, identify indicators of DNS abuse, and build a comprehensive threat assessment.

Part 1: DNS Alert Discovery

Filtering for DNS Traffic

In EveBox, use the search/filter bar to isolate DNS-related alerts. Try these filter approaches:

By protocol: Filter for alerts where the application protocol is DNS. Look for the protocol or event type fields in the alert details.

By signature keyword: Search for signatures containing "DNS" in the alert list. Note how many distinct DNS signatures are present.

By port: Filter for alerts involving port 53 (standard DNS). Be aware that some DNS tunneling may use non-standard ports.

Initial DNS Survey

Record the following baseline data:

DNS ALERT BASELINE
══════════════════
Total DNS-related alert groups: [count]
Unique DNS signatures: [count]
Source IPs generating DNS alerts: [list]
Destination IPs (DNS servers queried): [list]
Time range of DNS activity: [first] to [last]

Part 2: Indicator 1 — Unusually Long DNS Queries

What Makes a DNS Query "Long"?

Normal DNS queries are short:

• google.com = 10 characters
• mail.example.org = 16 characters
• subdomain.company.internal = 26 characters

DNS tunneling encodes data in subdomain labels, producing queries like:

• aGVsbG8gd29ybGQ.dG9wIHNlY3JldA.tunnel.evil.com = 48 characters
• 4f70657261746f6e20576972652054617.hex.c2server.net = 52 characters

Any DNS query consistently exceeding 50–60 characters warrants investigation.

Investigation Steps

1. Find alerts with signatures related to long DNS queries or DNS tunneling
2. Click into individual alerts and examine the DNS query field
3. For each suspicious query, record:

LONG DNS QUERY ANALYSIS
═══════════════════════
Alert Signature: [name]
Query: [full DNS query string]
Query Length: [characters]
Subdomain Pattern: [random/hex/base64/readable]
Base Domain: [the root domain being queried]
Source IP: [internal host making the query]
Frequency: [how many similar queries from this host]
Assessment: [tunneling / legitimate / uncertain]

Part 3: Indicator 2 — Queries to Suspicious Domains

Domain Reputation Indicators

Not all malicious DNS activity involves tunneling. Some indicators to look for:

Investigation Steps

1. In EveBox, identify alerts flagged as policy violations or known-bad domain queries
2. Extract the domain names from the DNS query fields
3. For each suspicious domain:

SUSPICIOUS DOMAIN ANALYSIS
══════════════════════════
Domain: [full domain]
TLD: [top-level domain]
Alert Signature: [what rule flagged it]
Queried By: [source IP]
Query Count: [how many times queried]
Pattern: [DGA / random / known-bad / policy violation]
Risk Level: [high / medium / low]

Click to enlarge

Part 4: Indicator 3 — DNS-Based C2 Patterns

How DNS C2 Works

In a DNS C2 channel:

1. Compromised host encodes commands/data into DNS queries (subdomains)
2. Attacker's DNS server receives the query and decodes the data
3. Attacker responds with encoded commands in DNS TXT, CNAME, or A records
4. Compromised host decodes the DNS response to get new commands

Behavioral Indicators of DNS C2

Investigation Steps

1. Find alerts related to DNS C2, beaconing, or trojan activity
2. Examine the timing pattern — are queries evenly spaced?
3. Check if TXT record queries are present
4. Determine if the queried domain has any legitimate purpose

DNS C2 PATTERN ANALYSIS
═══════════════════════
Suspect Domain: [domain]
Query Interval: [seconds between queries]
Record Type Requested: [A / TXT / CNAME / MX]
Total Queries in Session: [count]
Average Query Length: [characters]
Encoding Pattern: [base64 / hex / custom]
Associated Source IP: [internal host]
Verdict: [confirmed C2 / likely C2 / benign]

Part 5: Correlating DNS Indicators with the Attack Chain

Building the DNS Threat Timeline

Now connect your DNS findings to the broader Operation Wire Tap attack:

1. Pre-attack phase: Were there DNS queries for reconnaissance (e.g., querying target infrastructure)?
2. Exploitation phase: Did the compromised host start making unusual DNS queries after the web shell was deployed?
3. C2 phase: Can you identify the transition from normal to tunneling behavior?
4. Exfiltration phase: Do any DNS queries appear to carry encoded data outbound?

Cross-Reference with Non-DNS Alerts

Compare your DNS timeline with the non-DNS alerts you triaged in Lab 3.1:

• Do the DNS C2 queries start AFTER the SQL injection and web shell alerts?
• Is the host making DNS tunnel queries the same host that was exploited?
• Does the DNS C2 destination domain relate to any IP seen in other alerts?

Click to enlarge

Part 6: Build Your DNS Threat Assessment Report

Compile all findings into a formal report:

DNS THREAT ASSESSMENT REPORT
═════════════════════════════
Classification: [CONFIRMED THREAT / SUSPECTED THREAT / MONITORING]
Date: [today's date]
Analyst: [your name]

EXECUTIVE SUMMARY
─────────────────
[2-3 sentences describing the DNS-based threat activity observed]

DNS INDICATORS OF COMPROMISE
─────────────────────────────
1. Tunneling Domains: [list domains with encoded subdomain patterns]
2. C2 Domains: [list domains with beaconing behavior]
3. Suspicious TLDs: [list unusual TLDs observed]
4. Long Query Hosts: [internal IPs making anomalous DNS queries]

TIMELINE
────────
[Chronological list of DNS events correlated with attack phases]

RECOMMENDED ACTIONS
───────────────────
1. [Block identified C2 domains at DNS resolver]
2. [Isolate compromised hosts making tunnel queries]
3. [Add domains to threat intelligence blocklist]
4. [Implement DNS query length monitoring threshold]

Deliverable Checklist

Before completing the lab, ensure you have:

• DNS alert baseline — total groups, unique signatures, source IPs, time range
• Long query analysis — at least 3 suspicious queries with length, encoding pattern, and assessment
• Suspicious domain analysis — all flagged domains with TLD, query count, and risk level
• DNS C2 pattern analysis — at least 1 confirmed or suspected C2 channel with timing and encoding details
• Timeline correlation — DNS events mapped to the broader Operation Wire Tap attack phases
• DNS Threat Assessment Report — complete formal report with IOCs and recommended actions

What's Next

In Lab 3.4 — Two Views, One Attack, you will combine network-level detection (Suricata/EveBox) with SIEM-level detection (Wazuh alerts) to reconstruct the complete Operation Wire Tap attack from two complementary viewpoints. This is how professional SOC teams build comprehensive incident timelines.