# DNS as a Security Signal ## Almost every attack has to ask a question before it can do anything Malware needs to reach its operator. Exfiltration needs a destination. Both start with a name lookup, and that lookup happens before any payload moves. DNS is therefore the earliest point in the kill chain where an intrusion becomes observable, which is why security teams treat it as telemetry rather than plumbing. Four patterns carry most of the value: | Pattern | What it looks like | What it indicates | | --- | --- | --- | | **Beaconing** | regular, metronomic queries to the same domain | implanted malware checking in with command and control | | **DGA** | thousands of queries to algorithmically generated nonsense domains, nearly all failing | malware hunting for whichever generated domain its operator registered today | | **DNS tunneling** | abnormally long or high-entropy subdomain labels, high query volume to one zone | data being exfiltrated inside the query strings themselves | | **Sinkholing** | defensive, not an attack | known-bad domains answered with a controlled address so infected hosts reveal themselves | > [!tip] Why tunneling works at all > DNS is allowed out of almost every network, including ones that block everything else. An attacker who can make queries can move data, slowly, by encoding it in the names being requested. The channel is terrible and that is the point: nobody blocks it. > [!warning] The volume problem > A mid-size enterprise generates tens of millions of queries a day, overwhelmingly benign. The signal is real and the base rate is brutal, which is why this is a machine-learning problem rather than a rules problem, and why false-positive rates decide whether the product is usable. ## Why it matters DNS telemetry is the cheapest broad-coverage security signal available. It needs no endpoint agent, covers unmanaged and IoT devices that agents cannot reach, and fires earlier than anything at the payload layer. That is the commercial case for every vendor in [[DNS Security Vendor Landscape]], and the constraint on all of them is [[DoH and DoT]]. ## Related - [[DNS Resolution Mechanics]] - [[DoH and DoT]] - [[Cyber Kill Chain]] - [[SIEM - Security Information and Event Management]] - [[Security MoC]]