← DNS Investigations: Resolution, Telemetry, and Threat Decisions
1. Understand What DNS Evidence Represents
Trace the Resolution Chain Read Records, TTLs, and Negative Answers
2. Collect and Evaluate Suspicious DNS Activity
Know Your Resolver Telemetry and Blind Spots Assess Domains Without Turning Heuristics into Verdicts
3. Test Threat Hypotheses and Respond
Test Tunneling and Beaconing Hypotheses Pivot, Scope, Block, and Report
3. Test Threat Hypotheses and Respond

Test Tunneling and Beaconing Hypotheses

Analyze query volume, labels, types, timing, responses, and client behavior while controlling for software that legitimately produces machine-generated DNS.

In this lesson, you will learn to:

  • Construct a multi-feature test for DNS tunneling or beaconing.
  • Identify common benign systems that can produce similar query patterns.

Test Tunneling and Beaconing Hypotheses

Builds a practical feature set for suspected command-and-control or data transfer and emphasizes denominators, peer groups, and endpoint corroboration.

Measure behavior at client-domain resolution

DNS tunneling can encode command or data in query names or responses, but no single length, entropy, record type, or NXDOMAIN threshold proves tunneling. Aggregate at client and registered-domain level over defined windows. Measure query count, distinct labels, label length, character distribution, record-type mix, answer size, response codes, inter-arrival timing, upstream volume, and whether labels repeat across clients. Keep denominators: a resolver serving thousands of devices naturally produces more rare names than one endpoint.

Compare against relevant peers and known applications. Content delivery, tracking, software updates, endpoint security, certificate checks, service discovery, and telemetry can generate long, unique, or periodic names. Search-suffix mistakes and domain-generation-like retry logic can create NXDOMAIN bursts. Tunneling hypotheses become stronger when one unexpected process creates sustained unique subdomains under a narrow parent, queries or responses carry unusually high data volume, the behavior persists independent of user activity, and no approved application explains it.

Query behavior is a multi-feature profileVolume, unique labels, length, record types, response codes, timing, and client concentration are measured together.FIELD GUIDEQuery behavior is a multi-feature profileVolumeUnique labelsLength andcharactersTypes andresponsesTiming andclientsCHECKPOINTS1Volume2Unique labels3Length andcharactersQUERY PROFILE
Query behavior is a multi-feature profile — Volume, unique labels, length, record types, response codes, timing, and client concentration are measured together.

Corroborate the protocol hypothesis with endpoint and network evidence

Beaconing analysis also needs care. Scheduled software creates regular traffic, and jittered attacker traffic may be intentionally irregular. Plot intervals by client, process, and destination with missing-data awareness. Look for persistence across reboots, idle periods, and user sessions; changes after process termination; and alignment with network connections or file activity. A resolver cache can suppress repeated upstream lookups, so authoritative or upstream observations may not reflect every client request.

Pivot to endpoint telemetry for the initiating process, parent, command line, file signature, persistence, and network connections. Inspect TLS or proxy metadata for connections to resolved addresses, while accounting for shared hosting. Compare the domain with software inventory and owner records. If payload encoding is suspected, preserve samples under legal and privacy rules; decoded data can be sensitive. Escalate based on observed unauthorized behavior and impact, not a statistical feature alone. Document feature definitions so another analyst can reproduce the result.

Tunneling confidence grows through corroborationStatistical features pass through process, persistence, connection, application-owner, and impact checks before response.FIELD GUIDETunneling confidence grows through corroborationDNS patternUnexpectedprocessPersistentbehaviorConnection orimpactCHECKPOINTS1DNS pattern2Unexpectedprocess3PersistentbehaviorDECISION GATES
Tunneling confidence grows through corroboration — Statistical features pass through process, persistence, connection, application-owner, and impact checks before response.

Resources

  • NIST SP 800-81r3 publication — Read the complete current guide for DNS threat use, protective logging, recursive-service controls, and integration with security monitoring.
← Previous: Assess Domains Without Turning Heuristics into Verdicts Next: Pivot, Scope, Block, and Report →