medium10 pts · first answer countszeekthreat-huntingnetwork-security

Odd queries in Zeek dns.log

One host makes thousands of queries like these. Which conclusion and next step is best?

query: a9f3k2l0qz8x7v.dyn-updates.example.net  qtype: TXT
query: p0z81mnbv6c4ty.dyn-updates.example.net  qtype: TXT
query: x7c2v9b1n0m3qa.dyn-updates.example.net  qtype: TXT

A.Normal CDN traffic; close the alertB.A broken printer driver; reinstall itC.Possible DNS tunnelling or a DGA; check the process making the queries and the domain's age and reputationD.A DNSSEC validation error; disable DNSSEC

Discussion 0

Join free to post in the discussion.

Odd queries in Zeek dns.log

Discussion 0

Related questions