RR CYBERLAB • Network Security
DNS Investigation
Investigate DNS requests as both normal infrastructure activity and a possible security signal.
QUICK READ
DNS is essential to normal networking, so analysts should look for unusual domains, query frequency, record types, long or random-looking subdomains, unusual processes and unexpected destinations rather than treating DNS itself as malicious.
Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.
Investigation workflow
- Identify the requesting host and process when available.
- Review queried domain and record type.
- Check first-seen time, frequency and response IP.
- Look for long, random or rapidly changing subdomains.
- Compare with known business applications and normal resolver behavior.
- Pivot to endpoint and network events before and after the DNS request.
Suspicious patterns
- Very high query frequency.
- Rare domains or newly observed names.
- Large or unusual TXT usage.
- Non-browser processes generating unexpected DNS.
- DNS activity that aligns with periodic outbound connections.
False positives
CDNs, telemetry systems, software updates and cloud applications can create unusual-looking DNS. Validate the application, asset owner and expected business function.Example
A workstation queries a rarely seen domain every 60 seconds and then connects to the same resolved IP. The analyst should correlate process, user, domain history and network timing rather than declaring DNS tunneling from the query alone.MITRE ATT&CK context
MITRE ATT&CK lists DNS under Application Layer Protocol (T1071.004) and notes that adversaries can abuse DNS for command and control. Detection should distinguish normal DNS from anomalous behavior. citeturn0search0
Map only behavior supported by the evidence; do not assign a technique merely because it is possible.
Daily quiz hook
A host makes repeated DNS queries to a rare domain and then connects to the resolved IP. What evidence should you correlate next?
Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.
Analyst practice note
DNS investigation combines query frequency, record type, answer, resolver, host, and surrounding process or user activity. Periodicity and unusually long labels may raise a question, but caching, software updates, CDNs, and endpoint health checks can produce similar patterns.
In the quiet-beacon case, compare intervals and then pivot to the process and outbound connection. Record both supporting and conflicting evidence; a suspicious query alone does not establish command-and-control or compromise.
Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.