dns exfiltration, the tunnel nobody watches

nothing is leaving the network, except it is

every security tool in the building agrees. firewall's clean. proxy logs look fine. nobody uploaded anything to a sketchy ip. and yet the attacker just walked out with your root password, your customer database, or whatever else they wanted, one dns query at a time.

this is dns exfiltration, and it works because of a dumb, boring, unavoidable fact: everybody has to allow dns. you cannot block port 53 and still have a functioning network. so attackers stopped trying to sneak data past your firewall and started mailing it out through the one door that's always propped open.

how the tunnel actually works

dns exfil abuses the fact that a dns query can contain almost anything in the hostname field, and that field gets forwarded, cached, and resolved by servers all over the internet without anyone reading it for content. so malware on a compromised box takes whatever it stole, chops it into small chunks, encodes those chunks so they look like valid hostname characters, and tacks them onto a domain the attacker controls.

a stolen credential turns into something like this:

cm9vdDpTMWQzY2Fy.data.attacker-cdn.net

that ugly string in front isn't a subdomain someone registered. it's base64. the attacker's own dns server is authoritative for attacker-cdn.net, so every query for a subdomain of it eventually lands on their infrastructure, where they just read the query logs to reassemble the data. no file transfer, no outbound connection that lights up a firewall rule, nothing that looks like "uploading data" to most monitoring tools.

reading the capture like a defender

if you've got a packet capture, either from an ids, a span port, or your own lab traffic, you can pull every dns query of a given type straight out of it with tshark:

tshark -r cap.pcap -Y 'dns.qry.type==16' -T fields -e dns.qry.name

breaking that down:

-r cap.pcap reads from a saved capture file instead of sniffing live traffic. -Y applies a display filter, same syntax you'd type into wireshark's filter bar. dns.qry.type==16 means "only show me TXT record queries," which is a common exfil channel because TXT records are just free-form text, way roomier than the 63-character limit on a normal hostname label. -T fields -e dns.qry.name tells tshark to skip the pretty formatting and just dump the query name field, one per line, so you can pipe it into other tools.

when you decode one of those weird-looking labels, this is what falls out:

echo 'cm9vdDpTMWQzY2Fy' | base64 -d
root:S1d3car

that's a username and password, smuggled out through what everyone assumed was harmless lookup traffic.

the tell isn't the content, it's the volume

you almost never catch this by eyeballing decoded strings, because attackers rotate encodings and domains constantly. what you catch is the pattern. a human browsing the internet generates a handful of dns lookups per site per session. malware doing exfil generates thousands of queries to the same base domain in a short window, because it has to, since each query only carries a small chunk of data.

18,000 TXT lookups to a single domain in one hour is not a person checking their email. that's a machine narrating your data out loud, one label at a time. the volume, the record type, and the randomness of the subdomains are the real signature, not any specific decoded payload.

the takeaway

you don't need to inspect every dns packet by hand to catch this. you need visibility and a baseline. turn on dns query logging on your resolver or firewall if it's not already on, and actually ship those logs somewhere you can query them later. use tshark or a proper dns analytics tool to hunt for domains generating abnormal query volume, unusually long or high-entropy subdomains, and excessive TXT or NULL record lookups. block direct outbound dns to anything other than your approved resolvers, so internal machines can't bypass your logging by talking straight to the internet. and if you're running a resolver yourself, alert on any single client generating dns query volume that's way outside its normal pattern. the firewall was never going to catch this. your dns logs are the only witness that was actually in the room.