HighALERT-4202engine: heuristic
Possible DNS Tunneling Detected
analyst review
Raw alert — normalized QRadar offense
- asset
- dc-01-domain-controller
- protocol
- DNS :53
- src_ip
- 10.26.6.28
- dest_ip
- 10.20.2.10
- magnitude
- 7/10
- severity
- 8/10
- credibility
- 7/10
- relevance
- 9/10
- src network
- internal_corp
- events / flows
- 1,011 / 7,827
triggered rules
- ▹ Exfil: Abnormal Outbound Data Volume
- ▹ Exfil: High Entropy DNS Queries
full offense JSON
{
"offense_id": 4202,
"description": "Possible DNS Tunneling Detected :: Data Exfiltration targeting dc-01-domain-controller",
"offense_type": "Source IP",
"offense_source": "10.26.6.28",
"magnitude": 7,
"severity": 8,
"credibility": 7,
"relevance": 9,
"status": "OPEN",
"source_network": "internal_corp",
"destination_networks": [
"internal_corp"
],
"event_count": 1011,
"flow_count": 7827,
"start_time": "2025-11-03T04:50:00+00:00",
"last_updated_time": "2025-11-03T05:06:00+00:00",
"categories": [
"Data Transfer",
"Potential Data Loss/Theft"
],
"rules": [
"Exfil: Abnormal Outbound Data Volume",
"Exfil: High Entropy DNS Queries"
],
"assigned_to": null,
"dest_port": 53
}AI triage
Likely data exfiltration: Possible DNS Tunneling Detected from internal host 10.26.6.28 against dc-01-domain-controller (10.20.2.10) over DNS, 1,011 events observed.
MITRE ATT&CK
T1048Exfiltration Over Alternative ProtocolExfiltrationconfidence 79%
Alert indicators (Possible DNS Tunneling Detected; rules: Exfil: Abnormal Outbound Data Volume) overlap most strongly with T1048 Exfiltration Over Alternative Protocol among the ATT&CK shortlist.
Priority — High
Scored High based on: QRadar magnitude 7/10; high severity (8/10); credibility 7/10; data exfiltration pattern indicates likely post-compromise activity.
Recommended next steps
- 1.Quantify the outbound volume and destination reputation.
- 2.Isolate the source host and preserve evidence if egress is confirmed.
- 3.Identify what data the host had access to (data classification / DLP).
- 4.For DNS tunneling, inspect query entropy and the resolving domain.
Suggested hunting query (KQL)
CommonSecurityLog | where TimeGenerated > ago(24h) | where SourceIP == "10.26.6.28" | summarize Bytes=sum(SentBytes), Conns=count() by DestinationIP, DestinationPort | order by Bytes desc
ATT&CK candidate shortlist — matched before the model was called, so it justifies from real technique IDs
T1048Exfiltration Over Alternative Protocol·9.5T1041Exfiltration Over C2 Channel·8T1567Exfiltration Over Web Service·7.5T1207Rogue Domain Controller·5T1556.001Domain Controller Authentication·5T1071Application Layer Protocol·4.5T1583.002DNS Server·4.5