Firewalls block a lot - but DNS almost always gets out. That's exactly why attackers abuse it to exfiltrate data and run command-and-control when web traffic is filtered.
How it works
Data is encoded into the labels of DNS queries: a8f3c9b2.data.exfil-node[.]xyz. The attacker controls the authoritative server for the domain, so every query delivers a chunk of stolen data (or fetches a C2 command in the response). Slow, but very hard to block outright.
What it looks like
- High query volume to a single domain - thousands of lookups in minutes.
- Long, high-entropy subdomains - random-looking labels, unusually long names.
- Rare record types (TXT, NULL) used to carry more data.
- No cache hits - every name is unique by design.
How to detect it
Baseline normal DNS, then alert on the outliers:
- Queries-per-domain far above baseline.
- Average subdomain length / character entropy above a threshold.
- One internal host responsible for a spike to an unknown domain.
Zeek and your DNS resolver logs are the raw material. The signal isn't any single query - it's the distribution: normal DNS is short and repetitive; tunneling is long, unique and high-volume.