Wiki › Techniques, Tactics & Procedures (TTPs) › Exfiltration › DNS Data Exfiltration

DNS Data Exfiltration

2 min read

Jump to:

Overview

DNS Data Exfiltration is a technique where adversaries leverage the Domain Name System (DNS) protocol to covertly transmit stolen data from a compromised environment to an external recipient. This method exploits the ubiquitous and often less scrutinized nature of DNS traffic, enabling attackers to bypass traditional security controls and maintain stealth during the exfiltration phase of an attack lifecycle.

Attack Objective

Primary goal: stealthy data theft and exfiltration
Supports the Exfiltration stage of the attack lifecycle
Advances the attacker’s position by enabling extraction of sensitive information without triggering conventional data loss prevention mechanisms

How the Technique Works

Adversaries encode data into DNS queries or responses, typically by embedding information within subdomain labels or DNS resource record fields. These queries are sent to attacker-controlled DNS servers, which decode the embedded data. Because DNS traffic is often allowed through firewalls and proxies, this channel provides a covert pathway for data to leave the target network without raising immediate suspicion.

Common Methods & Variations

Encoding data in DNS query names (e.g., TXT, A, or CNAME record requests)
Use of DNS tunneling tools or custom scripts to automate data encoding and transmission
Variants targeting on-premises networks, cloud environments, and hybrid infrastructures
Living-off-the-land approaches leveraging native DNS client utilities versus custom malware or tunneling frameworks

Indicators of Compromise (IOCs)

Unusual volume or frequency of DNS queries to uncommon or suspicious domains
DNS queries with anomalous subdomain lengths or character sets indicative of encoded data
Presence of DNS requests for rarely used record types or large DNS response sizes
Network logs showing DNS traffic to external IPs not associated with legitimate services

Detection Strategies

Monitoring DNS query patterns and volumes via network sensors and DNS server logs
Behavioral analysis to identify irregular DNS request characteristics, such as entropy or uncommon domain structures
Correlation of DNS traffic with endpoint and network telemetry to detect anomalies

Mitigation & Prevention

Implement DNS filtering and allowlisting to restrict DNS queries to known legitimate domains
Enforce network segmentation and egress controls to limit DNS traffic to authorized resolvers
Deploy data loss prevention (DLP) solutions with DNS protocol awareness
Apply least privilege principles to reduce unnecessary DNS query capabilities on endpoints

Response Considerations

Immediately isolate affected systems to prevent further data exfiltration
Analyze DNS logs and network traffic to identify the scope and timeline of exfiltration
Conduct forensic examination of endpoint artifacts and DNS query payloads
Strengthen DNS security posture post-incident by updating filtering policies and monitoring rules

Related Techniques

Command and Control over DNS
Data Staged for Exfiltration
Use of Alternate Protocols for Data Exfiltration
Credential Access and Lateral Movement techniques that precede exfiltration

Mapping & References

MITRE ATT&CK Tactic: Exfiltration
MITRE ATT&CK Technique: Exfiltration Over Alternative Protocol (T1048), specifically DNS (T1048.001)
Public research and advisories on DNS tunneling and exfiltration methods from cybersecurity organizations and incident reports

Tags: ATT&CK Cybersecurity Data Exfiltration DNS DNS Tunneling Exfiltration Techniques network security Security Monitoring Threat Detection