Lekcje modułu (1/3)
Tunneling DNS i DGA
DNS tunneling and DGAs
DNS tunneling encodes data in DNS names or answers to use DNS as a transport channel. A domain-generation algorithm (DGA) creates many changing names to find command infrastructure. Possible signals include very long subdomains, high randomness, many NXDOMAIN responses, unusual frequency, or traffic concentrated on one host.
No one signal proves infection. CDNs, telemetry, mail systems, and legitimate applications can also create unusual patterns. Compare with a baseline and correlate the client identity, destination, process, endpoint telemetry, and timing. Keep logs with access and retention appropriate to privacy requirements.
For example, a training client making hundreds of requests to random-looking names in a few minutes deserves triage, not an automatic malware verdict. A defensive response can combine a managed resolver, telemetry, rate limits, classification, and host-level investigation. Use reasoned exceptions and expiry dates when blocking.
Check your understanding
Choose the best answer. The examples use training names and do not send real DNS queries.
What is a sound response to an unusual DNS pattern?