DNS Data Exfiltration via Long Subdomain Labels
08 DNS Data Exfil Long Labels
Query
ASimDnsActivityLogs
| where TimeGenerated > ago(24h)
| extend Labels = split(DnsQuery, ".")
| extend
Label0 = tostring(Labels[0]),
Label1 = tostring(Labels[1]),
Label2 = tostring(Labels[2])
| extend MaxLabelLen = max_of(strlen(Label0), strlen(Label1), strlen(Label2))
| where MaxLabelLen > 45
| extend QuerySize = strlen(DnsQuery)
| summarize
TotalQueries = count(),
EstimatedBytes = sum(QuerySize),
MaxLabelSeen = max(MaxLabelLen),
AvgLabelLen = round(avg(MaxLabelLen), 1),
SampleDomains = make_set(DnsQuery, 10),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by SrcIpAddr, SrcHostname
| extend EstimatedKB = round(todouble(EstimatedBytes) / 1024.0, 1)
| where EstimatedKB > 100Explanation
This query is designed to detect potential data exfiltration activities over DNS by identifying unusually long subdomain labels in DNS queries. Here's a simplified breakdown of what it does:
-
Purpose: The query aims to find instances where data might be secretly sent out of a network using DNS queries. Attackers can encode data into DNS subdomain labels, which are typically longer than normal in such cases.
-
Detection Method:
- It looks at DNS activity logs over the past 24 hours.
- It splits DNS queries into their subdomain components and checks the length of each component.
- If any subdomain label is longer than 45 characters, it flags it as suspicious (since legitimate domains rarely use labels longer than 30-35 characters).
-
Data Aggregation:
- It aggregates data by the source IP address and hostname.
- It calculates the total number of suspicious queries, the total estimated data volume transferred, and the longest subdomain label seen.
- It also provides a sample of up to 10 suspicious domain queries.
-
Alert Criteria:
- If a single client is found to have exfiltrated more than 100KB of data via these long subdomain labels in a 24-hour period, it triggers an alert.
-
Alert Details:
- The alert includes the hostname and IP address of the source, the number of suspicious queries, the maximum and average label lengths, the estimated data volume, and examples of the suspicious domains.
-
Severity and Context:
- The severity of this detection is marked as high, indicating a significant security concern.
- It is associated with tactics like Exfiltration and Command and Control, and it references specific MITRE ATT&CK techniques related to data exfiltration over non-standard protocols.
Overall, this query helps security teams identify and respond to potential data breaches where attackers use DNS queries to covertly transfer data out of a network.
Details
David Alonso
Released: July 28, 2026
Tables
Keywords
Operators
Severity
HighTactics
Frequency: 1h
Period: 24h