DNS Tunneling from a Finance Workstation
Secure Network Analytics reports finance workstation FIN-WS-22 sending 4.2 GB outbound over 72 hours to 203.0.113.90, a cloud VPS. Umbrella logs show 18,000 DNS TXT queries to random 32-character subdomains of 'sync-data[.]xyz'; the workstation normally sends less than 20 MB/day. The user is on approved leave and the workstation is powered on in the office. Secure Endpoint shows no alerts, but the EDR agent version is 7.5.1 and the console shows the host last checked in 11 days ago. The domain was registered 9 days ago and has no category. Legal has an open investigation into the finance team and asks that you not alert the user. The SOC must decide whether this is exfiltration, a misconfigured backup, or a test.
1. How do you validate or reject the exfiltration hypothesis?
Read the worked answer
The leading hypothesis is DNS tunneling and exfiltration. Indicators include 18,000 TXT queries to high-entropy subdomains, 4.2 GB in 72 hours against a 20 MB/day baseline, a newly registered uncategorized domain, and a cloud VPS destination. Benign explanations include a misconfigured backup or telemetry application, so check process attribution and approved software inventory. Because the EDR agent is stale, use network-based triage and a physical or remote host inspection. Review DNS logs, proxy, firewall, DHCP, and NetFlow. Validate query length and entropy; TXT is commonly used for data transfer. If no approved business application uses sync-data.xyz, treat it as malicious and coordinate with legal before contacting the user.
2. What containment respects the legal constraint without allowing ongoing loss?
Read the worked answer
Use covert containment: block sync-data.xyz and 203.0.113.90 at Umbrella and Secure Firewall; apply a NAC quarantine VLAN to FIN-WS-22 or EDR isolation if the agent can be updated; preserve memory before isolation if feasible. Weigh the legal preference against ongoing data loss: legal cannot require continued exfiltration, so stop the transfer even if the user is not alerted. Consider leaving the account enabled only if monitoring is tightly controlled and data loss is already stopped. Collect NetFlow, DNS, DHCP, and host artifacts, and check other finance hosts for the same domain. Coordinate all user-facing actions with HR and legal so the investigation is not compromised.
3. What evidence and notification analysis follows confirmation?
Read the worked answer
Export Secure Network Analytics flows, Umbrella DNS, firewall logs, DHCP leases, host memory and disk, browser history, and email records. Determine what data types left by correlating file access logs, DLP alerts, and the finance application's audit trail. Preserve chain of custody and document the stale EDR agent as a detection gap. Legal and HR decide on privacy, interview timing, and breach notification based on data classification. Do not delete host logs or rebuild until imaging is complete. Remediate the endpoint agent and scan the fleet. If confirmed exfiltration, assess regulatory reporting deadlines and notify management through the incident process.