DNS Hunting — DGA, Tunnelling, and Fast-Flux from Hypothesis to Finding

DNS is the most abused protocol in adversary tradecraft — it’s allowed outbound everywhere, it’s often not inspected, and it’s the universal naming system that every C2 implant must use to find its server. DNS hunting finds adversaries hiding in the protocol.

The DNS Hunter’s Query Pipeline

Every DNS hunt follows the same pipeline:

ALL DNS QUERIES
      │
      ▼ Step 1: Top-N filter (remove known-good domains)
RARE DOMAIN SET
      │
      ▼ Step 2: Apply behavior-specific filter (DGA entropy, tunnelling volume, etc.)
CANDIDATE SET
      │
      ▼ Step 3: Pivot (WHOIS, passive DNS, endpoint source process)
VERDICT

Never skip Step 1. Without the top-N filter, Steps 2 and 3 are buried in noise.

DGA Hunt

Hypothesis: A host infected with DGA malware is rotating through algorithmically-generated domain names seeking its C2. Evidence: high NXDOMAIN volume, high-entropy domain labels, burst pattern.

Step 1: NXDOMAIN Ratio Hunt

Zeek_dns_CL
| where TimeGenerated > ago(7d)
| summarize 
    total_queries = count(),
    nxdomain_count = countif(rcode_name_s == "NXDOMAIN"),
    noerror_count = countif(rcode_name_s == "NOERROR")
  by id_orig_h_s, bin(TimeGenerated, 1h)
| extend nxdomain_ratio = toreal(nxdomain_count) / toreal(total_queries)
| where nxdomain_ratio > 0.25 and nxdomain_count > 30  // >25% NXD + >30 in 1h
| order by nxdomain_ratio desc

Step 2: Domain Entropy Filter

// Add entropy calculation (approximate using label length as proxy)
Zeek_dns_CL
| where TimeGenerated > ago(1h)
| where rcode_name_s == "NXDOMAIN"
// Extract second-level domain label
| extend sld = tostring(split(query_s, ".")[-2])
| extend label_len = strlen(sld)
| where label_len between (8 .. 20)  // DGA sweet spot: not too short, not CDN hash
// Approximate entropy filter: no repeated vowel patterns (heuristic)
| where not(query_s matches regex @"[aeiou]{2}")  // consonant-heavy = high entropy
| summarize 
    nxd_count = count(),
    sample_labels = make_set(sld, 5)
  by id_orig_h_s
| where nxd_count > 30

Step 3: Validate with WHOIS on NOERROR Domains

After filtering, find the few NOERROR responses (the active C2 domains):

Zeek_dns_CL
| where TimeGenerated > ago(1h)
| where rcode_name_s == "NOERROR"
| where id_orig_h_s in (dga_candidate_hosts)  // from previous query
| project TimeGenerated, id_orig_h_s, query_s, answers_s

WHOIS on each NOERROR domain will show recent registration — DGA C2 domains are always fresh.

DNS Tunnelling Hunt

Hypothesis: A host is exfiltrating data or maintaining C2 via DNS by encoding data in query subdomains and reading responses from TXT records.

Step 1: High-Volume TXT/NULL Query Hunt

Zeek_dns_CL
| where TimeGenerated > ago(24h)
| where qtype_name_s in ("TXT", "NULL")
// Exclude legitimate TXT senders: SPF/DMARC checkers, mail servers
| where not(id_orig_h_s in (mail_server_ips))
| summarize 
    query_count = count(),
    unique_domains = dcount(tostring(split(query_s, ".")[-2]))  // unique eTLD+1
  by id_orig_h_s
| where query_count > 50    // >50 TXT queries in 24h = anomalous for workstation
| order by query_count desc

Step 2: Unique FQDN Ratio (Tunnelling Signature)

// Find domains with many unique subdomains (tunnelling) vs one subdomain repeated (DGA)
Zeek_dns_CL
| where TimeGenerated > ago(24h)
| where id_orig_h_s in (tunnelling_candidates)
| extend registered_domain = tostring(strcat(split(query_s, ".")[-2], ".", split(query_s, ".")[-1]))
| summarize 
    unique_fqdns = dcount(query_s),
    query_count = count(),
    avg_label_len = avg(strlen(tostring(split(query_s, ".")[0])))
  by id_orig_h_s, registered_domain
| where unique_fqdns > 30           // many unique subdomains to same registered domain
| where avg_label_len > 30          // long first labels = encoded data
| order by unique_fqdns desc

Step 3: Decode a Sample Subdomain

# Take the first label of a suspicious query:
# e.g., query = "V2hhdCBpcyB0aGUgYW5zd2VyIHRvIGxpZmU=.tunnel.attacker.com"
first_label="V2hhdCBpcyB0aGUgYW5zd2VyIHRvIGxpZmU="
echo "$first_label" | base64 -d
# → "What is the answer to life"

Decoded text confirms exfiltration. Binary output (file bytes) confirms data staging. Command strings confirm C2.

Volume estimation:

Queries observed: 847 over 2 hours
Average label length: 52 characters
Base64 efficiency: 0.75 (3/4 — 4 base64 chars = 3 bytes)
Data volume: 847 × 52 × 0.75 ≈ 33,000 bytes ≈ 33 KB

Slow but persistent tunnelling (47K/day) can exfiltrate meaningful data over weeks.

Fast-Flux Hunt

Hypothesis: An adversary is using a fast-flux DNS configuration to prevent IP-based blocking of their C2 infrastructure.

Zeek_dns_CL
| where TimeGenerated > ago(24h)
| where rcode_name_s == "NOERROR"
| where id_orig_h_s in (hunt_scope_hosts)
// Group by domain, find domains with many unique IP answers
| extend answers = split(answers_s, ",")
| mv-expand answer = answers to typeof(string)
| summarize 
    unique_answers = dcount(answer),
    min_ttl = min(toint(TTLs_s)),
    query_count = count()
  by query_s
| where unique_answers >= 5      // ≥5 different IPs for same domain
| where min_ttl <= 60            // TTL ≤ 60 seconds (rotation every minute)
| order by unique_answers desc

Legitimate CDN false positives: Some major CDNs (Akamai, CloudFront) rotate IPs with low TTL for load balancing. Filter: CDN-flagged domains (top-N list or ASN lookup on resolved IPs). Legitimate CDN = IPs in same ASN. Fast-flux = IPs in many different ASNs (each a compromised bulletproof host).

Worked Example

DNS tunnelling hunt: from hypothesis to IOC extraction

PEAK Hypothesis: A host is exfiltrating data using DNS tunnelling over TXT records to a domain not in our passive DNS baseline. The host would show >100 TXT queries in 24 hours, with subdomain labels > 30 characters.

Hunt Step 1 — TXT volume filter:

Results: 3 hosts with TXT query count > 100 in 24h:
  10.4.2.11 → 612 TXT queries to subdomains of cdn-telemetry.io
  10.1.1.5  → 134 TXT queries to _dmarc.corp.com (mail server — EXCLUDE)
  10.3.3.22 → 89 TXT queries to various (weather apps, SPF checks — EXCLUDE)

One candidate: 10.4.2.11.

Hunt Step 2 — Unique FQDN and label length:

Domain: cdn-telemetry.io
Unique FQDNs: 612 (every query has unique subdomain — perfect for tunnelling)
Avg first-label length: 55.3 characters
Min: 48, Max: 64 — consistent with base64 padding

Hunt Step 3 — Decode sample:

# Sample label: "dGhpcyBpcyB0ZXN0IGRhdGEgZm9yIHRoZSBodW50aW5nIGxhYg=="
echo "dGhpcyBpcyB0ZXN0IGRhdGEgZm9yIHRoZSBodW50aW5nIGxhYg==" | base64 -d
# Output: "this is test data for the hunting lab"
# (realistic: would be binary file data or structured JSON)

Hunt Step 4 — WHOIS:

cdn-telemetry.io registered: 6 days ago
Registrar: NameCheap (common in attacker infra)
Registrant: REDACTED
NS: ns1.cdn-telemetry.io (custom nameserver = attacker runs authoritative DNS)

Volume estimate:

612 queries × 55 chars × 0.75 (b64 ratio) = 25,245 bytes ≈ 25 KB exfiltrated
Extrapolated over 1 week: 175 KB — potentially sensitive credential/key material

IOCs:

Domain: cdn-telemetry.io
IP (nameserver resolved to): 185.220.101.7
Host: 10.4.2.11 (pivot to endpoint for source process)

PEAK Act — converted to detection:

title: DNS TXT Tunnelling — High-Volume Unique Subdomains
logsource:
  category: dns
detection:
  selection:
    dns.question.type: TXT
  timeframe: 1h
  condition: selection | count(dns.question.name) > 50 by src_ip AND
             selection | avg(length(dns.question.name.first_label)) > 30 by src_ip
level: high

Retrieval Practice

A DNS hunt finds host 10.3.1.7 with 92% NXDOMAIN ratio over 1 hour, querying domains like 'k7f2m1p4q9.cdn-delivery-api.net'. WHOIS shows cdn-delivery-api.net was registered 3 days ago. What is the verdict, what do you pivot to next, and what does the PEAK Act phase produce?

Reveal answer

High confidence DGA-infected host. The NXDOMAIN ratio (92%), entropy-consistent label structure (k7f2m1p4q9 is 10 alphanumeric characters with no vowel clustering), recent domain registration, and high query volume all align with DGA malware. Next pivots: (1) Endpoint — Sysmon Event 3 or EDR DNS event to identify which process on 10.3.1.7 is generating these queries. Process name/path will identify the malware family or binary. (2) Search for NOERROR responses — which of the queried domains actually resolved? That's the active C2. WHOIS + VT on the active domain confirms family. (3) conn.log — did 10.3.1.7 establish a connection to the resolved IP? If so, C2 channel is confirmed. PEAK Act: (a) escalate to IR for endpoint isolation, (b) sinkhole the registered domain family (wildcard), (c) write Sigma rule targeting high-NXDOMAIN-volume + domain entropy pattern.