dnstunneling
Explanation
The dnstunneling NDM is designed to detect DNS tunneling on your network. DNS tunneling is a technique used by malicious actors to bypass firewalls and security appliances to exfiltrate data from a network. The NDM monitors DNS queries and responses to detect any unusual or suspicious activity.
What to Look For
When examining the results of the dnstunneling NDM, look for patterns of DNS traffic that do not match typical behavior on your network. This can include a large volume of DNS queries or responses with long domain names or unusual query types. Additionally, look for network endpoints that are communicating with suspicious domains or IP addresses.
To remediate the issue, investigate the source of the suspicious DNS traffic and block any domains or IP addresses associated with the activity. Additionally, consider implementing DNS security solutions to prevent DNS tunneling and other DNS-based attacks.
Related MITRE ATT&CK Categories
Updated 20 days ago