NXDOMAIN Burst and a 61-Second Heartbeat on a Finance Workstation
At 02:10 on a Tuesday the IDS raises 3,412 DNS NXDOMAIN events in 11 minutes, all from 10.20.4.77, a Windows 10 workstation in the finance department. The queries are for 8–14 character random-looking labels under four second-level domains registered within the last six days, all hosted in the same /24 of a hosting provider. In the same window the sensor logs 34 outbound TLS sessions from that host to the same /24, spaced 60–66 seconds apart, each carrying 900–1,100 bytes outbound and 300–500 bytes inbound. Proxy logs show the user browsing normally until 18:40 the previous evening. Antivirus is current and reports nothing; EDR shows no alerts, but its process tree records wscript.exe launched by EXCEL.EXE at 18:37. The SOC triage SLA is 15 minutes and the on-shift analyst has not seen these domains before.
1. Decide whether this is DGA-driven command and control or benign software, and justify the call from the specific evidence rather than from the alert name.
Read the worked answer
It is DGA-driven command and control with high confidence, but the reasoning has to be explicit because the evidence cuts both ways.
For compromise:
- 3,412 NXDOMAIN in 11 minutes from one host is not a resolver or user pattern; it is a machine iterating a seed.
- The labels are random-looking and spread across four domains registered in the last six days on a single hosting /24. Legitimate telemetry uses one stable vendor domain, not four fresh ones.
- 34 sessions at 60–66 second spacing with low, consistent byte counts is beaconing with jitter - human traffic does not produce that cadence for 34 consecutive minutes.
- The decisive artifact is the process tree: EXCEL.EXE spawning wscript.exe at 18:37, three minutes before normal browsing stops. That is a macro-to-script execution chain, and it is the only explanation on the host for a new outbound process.
Against, and why it does not hold: current AV and a clean EDR console argue the payload is either fileless or living in a script interpreter AV does not score; 'no alerts' means no rule matched, not that nothing happened. A telemetry agent would show a signed binary and a stable vendor domain, and would not have an Excel parent.
The correct label is probable active C2 following successful execution - not 'DNS anomaly'.
2. What do you do in the first 15 minutes, in order, given the SLA?
Read the worked answer
Order matters because two actions are irreversible.
- Contain the host via EDR network isolation, not shutdown. Isolation keeps the agent channel alive and, critically, keeps memory intact. Powering off or reimaging destroys the injected code and the beacon configuration, which is what scope determination depends on.
- Block the four domains and the hosting /24 at the egress proxy and DNS resolver. The beacon has already sent ~34 KB outbound; stopping the channel is cheap and reversible, and blocking at two layers prevents a fallback to direct IP.
- Open an incident ticket with the process tree and a memory-capture request. Ask the endpoint team for a full memory image and the EXCEL.EXE file, hash and sender. This is time-sensitive because the file may be deleted from Outlook by the user or by retention.
- Hunt sideways in the same 15 minutes. Query DNS and proxy logs across all hosts for the four domains and for wscript.exe with a mail client or Excel parent in the last 7 days. The IDS only saw one host; the resolver sees all of them.
- Escalate to tier 2 and notify the finance department manager that the workstation is offline, without describing the malware, so the user does not log in from a personal device.
Blocking egress before isolation is acceptable, but isolation must not wait for the memory capture to be scheduled.
3. A colleague argues the case is probably a false positive: antivirus is current, EDR shows no detections, and a regular 60-second heartbeat looks like a legitimate agent. Refute or accept that argument with specifics.
Read the worked answer
Reject it, but on evidence rather than seniority.
- 'Regular heartbeat equals legitimate agent' is a category error. A 60–66 second interval is jittered, not regular. Vendor agents typically use fixed intervals or documented backoff; randomised jitter is a deliberate anti-pattern-matching technique. Legitimate agents also do not resolve random subdomains of four domains that are days old.
- Freshness is the tell. All four domains registered within six days on one hosting /24 is infrastructure staging, not a vendor's CDN estate. A real agent's domain would be old, have a certificate history, and appear in other hosts' logs.
- Clean AV and clean EDR are absence of evidence. Both are strongest against known binaries. The Excel-to-wscript chain means execution happened through a signed interpreter, which is exactly the gap these tools leave unless script-block logging and AMSI are feeding the console.
- The falsifiable test is to check the wscript.exe command line, the script's path and signature, and the prevalence of that script hash across the fleet. If the script is unsigned, sits in %TEMP% or %APPDATA%, and exists on exactly one host, the benign-agent hypothesis is dead.
Do not close the ticket on tool status alone; close it when the process lineage is explained.