Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

A Security Operations Center (SOC) team receives an automated alert generated by their Security Information and Event Management (SIEM) system regarding suspicious outbound traffic from host IP 10.10.4.15. The team pulls the following correlated telemetry logs:

[Sysmon Event ID 22 - DNS Query]
ProcessImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
QueryName: aW50ZXJuYWwtZGF0YS0wMQ.exfil.attacker-domain.com
QueryStatus: 0 (SUCCESS)

[Perimeter Firewall Egress Log]
SrcIP: 10.10.4.15 | DstIP: 198.51.100.45 | DstPort: 53 | Protocol: UDP | Action: ALLOWED | BytesSent: 1420

[SIEM Correlation Engine Alert]
Rule_ID: RULE_DNS_HIGH_ENTROPY_SUBDOMAINS
Condition: Count(DNS_Query) > 500 per 60 seconds targeting unique high-entropy subdomains of a single domain.

Based on the log telemetry and correlation rule output, which of the following best identifies the active attack vector and the underlying operational reason it bypassed initial perimeter controls?

  1. DNS tunneling data exfiltration, which exploited uninspected outbound UDP port 53 traffic permitted for domain name resolution.Answer
  2. B
    Cross-Site Scripting (XSS) payload execution, which exploited improper input sanitization in a web application query string.
  3. C
    SQL injection command execution, which manipulated database parameters to extract system tables over standard database ports.
  4. D
    Unauthorized privilege escalation, which resulted from a failure to enforce multi-factor authentication during administrative logon.

Answer

DNS tunneling data exfiltration, which exploited uninspected outbound UDP port 53 traffic permitted for domain name resolution.
The correct answer identifies DNS tunneling data exfiltration. The telemetry clearly demonstrates a script (PowerShell) emitting high-frequency DNS queries featuring encoded strings in the subdomain section to an external attacker-controlled domain. Outbound UDP port 53 is commonly left open for host name resolution, which allowed the exfiltration channel to operate until flagged by the SIEM's entropy-based correlation rule.

Step-by-Step Solution

1
Analyze the process and query parameters in the Sysmon Event ID 22 log entry.
Identified PowerShell executing DNS lookups against encoded strings embedded as subdomains (e.g., 'aW50ZXJuYWwtZGF0YS0wMQ.exfil.attacker-domain.com').
Attackers encode stolen binary or text data into DNS queries to bypass standard payload inspection.
2
Examine the firewall log and SIEM correlation rule trigger.
Confirmed that outbound UDP port 53 traffic from host 10.10.4.15 was allowed, and the SIEM recorded >500 high-entropy subdomain requests per minute.
Firewalls often allow outbound DNS traffic (port 53 UDP) implicitly for operational lookup capability, enabling DNS tunneling exfiltration if outbound queries are not restricted to internal recursive resolvers.
3
Synthesize the indicators to confirm the threat vector.
Matched high-frequency encoded subdomain queries over UDP port 53 with DNS tunneling for exfiltration.
The payload pattern and network path match DNS protocol misuse rather than web application attacks or authentication failures.

Key Concept

DNS Tunneling and Log Correlation
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic