Examkin

Question

Difficulty: Very hardLog Analysis and SIEM Management

A Security Operations Center (SOC) analyst is evaluating DNS server query logs forward-collected by a SIEM platform after an internal endpoint exhibited anomalous egress bandwidth usage. The analyst extracts the following sample log entries from internal host 10.0.12.85 over a brief period:

text
2026-07-27T08:14:02Z client 10.0.12.85#49152 query: v1-dGhpcyBpcyBhIHRlc3Q.data.corp-update.net IN TXT + (10.0.0.2)
2026-07-27T08:14:05Z client 10.0.12.85#49153 query: v1-c2VjcmV0IGRvY3VtZW50.data.corp-update.net IN TXT + (10.0.0.2)
2026-07-27T08:14:09Z client 10.0.12.85#49154 query: v1-ZXhmaWx0cmF0ZWQgZGF0YQ.data.corp-update.net IN TXT + (10.0.0.2)

Standard volume-based DNS threshold alerts failed to trigger because the query frequency remained low. Which of the following SIEM correlation rule enhancements would be MOST effective for detecting this specific exfiltration technique while minimizing false positives?

  1. Incorporate string entropy calculation and subdomain length evaluation combined with high unique TXT query ratios directed toward external second-level domains.Answer
  2. B
    Lower the aggregate DNS query count threshold to trigger an alert whenever any internal endpoint exceeds 50 total DNS requests per minute across all record types.
  3. C
    Configure a Web Application Firewall (WAF) signature rule to perform deep packet inspection for SQL injection syntax embedded in outbound UDP port 53 packets.
  4. D
    Deploy a decoy honeypot DNS recursive resolver on the network perimeter to serve as a detective security control that automatically drops outbound UDP datagrams.

Answer

Incorporate string entropy calculation and subdomain length evaluation combined with high unique TXT query ratios directed toward external second-level domains.
The provided log snippet shows Base64-encoded strings placed within the host portion of DNS TXT queries targeting an external domain name. Because adversaries slow down request rates to evade basic query volume alerts, effective SIEM rules must evaluate statistical properties of the log data—specifically high character entropy (randomness), unusually long subdomain lengths, and high ratios of unique subdomains to a single domain destination.

Step-by-Step Solution

1
Analyze the log entries for specific structural patterns.
The queries feature highly variable, randomized prefixes (e.g., 'dGhpcyBpcyBh...') prepended to a common base domain ('data.corp-update.net') requesting TXT records.
This structural pattern indicates Base64-encoded payload fragments being transmitted outbound via DNS queries (DNS tunneling/data exfiltration).
2
Evaluate why standard SIEM correlation rules (volume thresholds) failed.
The query intervals (3–4 seconds apart) fall well below standard high-frequency burst detection metrics.
Adversaries intentionally throttle requests to bypass simplistic volumetric rate alerts.
3
Determine the optimal SIEM detection metric for low-and-slow DNS tunneling.
Calculating Shannon entropy (randomness of string characters), checking long subdomain labels, and tracking high counts of unique subdomains per domain name effectively flags encoded exfiltration payloads.
Encoded strings have significantly higher entropy than standard human-readable domain names, providing high detection fidelity with minimal false positives.

Key Concept

DNS Tunneling Detection and SIEM Rule Tuning
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic