{"componentChunkName":"component---src-components-mark-down-block-js","path":"/docs/dns-data-exfiltration/","result":{"data":{"markdownRemark":{"html":"

Introduction DNS

\n

DNS (Domain Name System) is a fundamental internet protocol responsible for translating domain names into IP addresses. DNS is intended to take on the role of a phone book for the internet; therefore, it is a universally used and trusted worldwide protocol. DNS uses port 53, which is almost always open on systems and are not be blocked to prevent DNS traffic from firewalls. Many organizations do not decide to monitor DNS traffic for malicious activity. The lack of monitoring and restrictions of the DNS protocol is the reason why attackers often abuse DNS as a way of performing cyberattacks against victim machines. This oversight can have dramatic consequences.

\n

Here is the overview of the attack vector using DNS :

\n

\n \n \n

\n

Demo

\n

Here is the example detection of DNS tunneling which is used by iodine project

\n

\"Dns-demo\"

\n

Example notification

\n

Here is the overview of example alert notification which can be seen in Slack:

\n

\n \n Cribl Community Slack, where you can share your experiences using AppScope and the exciting things you uncover with it.

","frontmatter":{"title":"Detecting DNS Data Exfiltration"}}},"pageContext":{"slug":"/dns-data-exfiltration/","id":"afdb36aa-ab25-54ae-9fc4-048f5a726b2f"}},"staticQueryHashes":["2787008656","306729481","625673991","640077088"]}