File names leaving in DNS queries

TXT lookups with long hex labels leave one client every minute. Extract the labels, decode them, map the client IP to a laptop through DHCP, and find the process from EDR.

Terminal mission
Advanced
5 objectives
0 of 5 solved

Briefing

The resolver’s anomaly report flagged cloud-telemetry.example: few queries, but every label is a long hex string and the record type is TXT.

DNS tunnels put data in the leftmost labels of names under a domain the attacker controls. The resolver log has the queries, DHCP maps the IP to a machine, and EDR knows the process.

analyst@ir-ws

ir-ws · Capstone investigations

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@ir-ws:~/case-2349$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.