DNS Beacons Across 320 Stores
Meridian Retail operates 320 stores and 8,000 endpoints. The DNS logging pipeline shows 200–400 queries per day to high-entropy subdomains of a single domain, with TXT responses up to 4 KB. Outbound TCP 443 is allowed to any destination, and the proxy logs show periodic POSTs to newly registered domains. Thirty percent of endpoints have EDR alerts suppressed because of a performance tuning exception, and browsers have DNS-over-HTTPS enabled, so corporate DNS logs are incomplete. The SOC has one analyst per shift. Store point-of-sale systems are on a separate VLAN but share the same egress path. Leadership wants to block the domain immediately and move on. The SOC's DNS sensor only covers the corporate resolver, not store-level LTE failover links.
1. How should the SOC validate and scope the suspected DNS exfiltration before simply blocking the domain?
Read the worked answer
Do not just block and close. Preserve DNS and proxy logs, then identify the internal hosts making the queries and the processes responsible where EDR telemetry exists. Correlate query timing, entropy, TXT response size, proxy POSTs, and newly registered domains. Check whether the store-level LTE failover links show the same pattern. Isolate one affected host for forensic imaging and memory capture. Blocking immediately may stop exfiltration, but it can also tip off the actor and destroy visibility; contain point-of-sale systems first, then sinkhole the domain with logging rather than silently dropping it. If exfiltration is confirmed, escalate to incident response and legal. The goal is to determine scope, data type, and actor before choosing containment timing.
2. What containment and eradication actions should follow confirmation?
Read the worked answer
Isolate affected endpoints, but preserve evidence before rebuilding. Sinkhole or block the domain at the resolver and proxy while continuing to log attempts. Disable DNS-over-HTTPS through browser policy so corporate DNS visibility is restored. Reset credentials for affected users, hunt for persistence mechanisms, and check whether point-of-sale systems or store controllers were touched. Because outbound 443 is open to any destination, add temporary egress restrictions except for approved business destinations. Notify legal and privacy teams if card data or personal data may be involved. Eradicate malware and rebuild where integrity is uncertain. Validate containment across the LTE failover path, not only the corporate resolver.
3. What long-term detection and architecture changes should Meridian make?
Read the worked answer
Fix the blind spots rather than adding more alerts for one analyst to triage. Enforce an enterprise DNS-over-HTTPS policy so DNS logs are complete, and extend DNS sensors to store failover links. Restrict outbound 443 to approved destinations and require proxy inspection or TLS metadata logging. Remove broad EDR exclusions or replace them with a lighter sensor that preserves alerts. Add network detection for beaconing and newly registered domains, DNS sinkholing, and threat intelligence. Automate correlation so 200–400 queries are scored and grouped, not manually reviewed. Staffing one analyst per shift cannot sustain manual triage, so invest in playbooks and automation. Test the new detections with a purple-team exercise.