Skip to main content
Tier One
High

DNS tunneling suspected from a plant floor gateway

A-1070

00:00time on this alert, target 10 minutes

Back to queue

Alert details

Source
IDS
Detection rule
IDS-DNS-TUNNEL-006
Affected user
m.okafor
Affected host
PLC-GW-01
Source IP
10.20.60.5
First seen
2026-07-24T18:28:00Z

Why this fired, in plain English

A computer sent a huge number of odd-looking DNS lookups. Attackers can smuggle data out inside DNS requests.

Suggested playbook

Data exfiltration to external storage

  1. 1. Determine whether the destination account is corporate or personal.
  2. 2. Compare volume against the host's own baseline, not an absolute number.
  3. 3. Identify the process: a backup agent and a browser upload mean very different things.
  4. 4. Check the classification and how many files were involved.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. Guided hint: this line matters

    ts=2026-07-24T18:25:00Z src="dns" event=query_burst src_ip=10.20.60.5 domain="*.telemetry-sync.example" query_count=8412 window_sec=180 avg_label_len=48 type=TXT

    TXT lookups with very long random-looking names are the classic shape of data hidden inside DNS.

  2. Guided hint: this line matters

    ts=2026-07-24T18:25:04Z src="dns" event=query src_ip=10.20.60.5 qname="a3f9c2e1b7d4a8f6c0e2b9d7a1f3c5e8.telemetry-sync.example" type=TXT rcode=NOERROR answer_len=210

  3. Guided hint: this line matters

    ts=2026-07-24T18:26:11Z host=PLC-GW-01 event=process_list process="/opt/vendor/plcsync" ppid=1 user="root" started="2026-07-24T18:24:51Z" package_verified=false

    An unverified binary started running as root just before the DNS burst began.

Related events

The order things happened in.

  1. 18:24Z

    Unverified process starts as root

  2. 18:25Z

    8,412 long TXT queries in 3 minutes

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 4 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.