long_dns_connection

Explanation

The long_dns_connection NDM flags sustained interactive connections leaving the customer's network to destinations on TCP port 53, which is used by DNS. Most DNS connections are short lived, so a long connection is anomalous and may be an indicator of DNS tunneling.

What to Look For

Check external destination hosts to verify that they are valid DNS servers. Check internal hosts to confirm that they are not compromised or infected with malware.

Related MITRE ATT&CK Categories

Protocol Tunneling, Techniques T1572