Examkin

Soru

Zorluk: OrtaLog Analysis and SIEM Management

A security analyst reviewing SIEM alert logs identifies the following sequential events originating from an internal workstation:

2026-07-27T14:02:11Z Event: DNS_QUERY SrcIP: 10.0.4.150 DstIP: 8.8.8.8 Query: c2FtcGxlZGF0YWV4Zmls.malicious-domain.com RecordType: TXT Length: 512
2026-07-27T14:02:12Z Event: DNS_QUERY SrcIP: 10.0.4.150 DstIP: 8.8.8.8 Query: dG9wc2VjcmV0ZG9jcw==.malicious-domain.com RecordType: TXT Length: 512
2026-07-27T14:02:13Z Event: DNS_QUERY SrcIP: 10.0.4.150 DstIP: 8.8.8.8 Query: cGFzc3dvcmRoYXNoZXM=.malicious-domain.com RecordType: TXT Length: 512

Which of the following security threats is directly indicated by these log entries?

  1. DNS tunneling used for covert data exfiltrationCevap
  2. B
    A DNS amplification attack targeted at saturating internal network switches
  3. C
    Cross-Site Scripting (XSS) attempting to steal session cookies
  4. D
    An unauthorized Kerberos ticket granting request attempting identity spoofing

Cevap

The correct answer is DNS tunneling used for covert data exfiltration.
The log entries demonstrate DNS tunneling. The presence of rapidly generated TXT record queries containing unique, Base64-encoded subdomains sent to an external domain indicates that an internal host is encoding data into DNS queries to bypass traditional firewall and proxy filters for data exfiltration.

Adım Adım Çözüm

1
Analyze the log entries for protocol type, query format, and record attributes.
The logs reveal repeated outbound DNS queries asking for TXT records with long, Base64-encoded strings as subdomains under an external domain (malicious-domain.com).
Identifying encoded payloads embedded inside DNS subdomains distinguishes protocol tunneling from standard hostname resolution requests.
2
Evaluate the pattern against known threat tactics.
Attackers encode sensitive data (such as Base64 strings decoding to 'sampledataexfil', 'topsecretdocs', and 'passwordhashes') into DNS queries to bypass standard perimeter security controls.
DNS traffic is frequently allowed outbound without inspection, making TXT record queries an ideal vehicle for covert data exfiltration.

Anahtar Kavram

DNS Tunneling and Data Exfiltration Detection in SIEM Logs
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Log Analysis and SIEM Management

Bu konudan daha fazla soru