312-39V2: Certified SOC Analyst v2

Question

Juliea, a SOC analyst, noticed large TXT and NULL payloads while monitoring logs. What does this indicate?

Explanation

Large DNS TXT and NULL record payloads can carry encoded data through DNS, indicating DNS tunneling used for data exfiltration. MITRE ATT&CK identifies DNS as a protocol that adversaries may use to conceal data exfiltration within protocol fields.

Learn more

MITRE ATT&CK: Exfiltration Over Alternative Protocol—Unencrypted Non-C2 Protocol

312-39V2: Certified SOC Analyst v2

AstroTutor

Notes

Readiness

QuestionQ156

Community Discussion