Incident Analysis - DNS Exfiltration

Date: Sep 12, 2026
Tags: SOC Digital Forensics Endpoint Security Threat Hunting Log Correlation Process Causality MITRE ATTACK SIEM DNS Wazuh Sysmon PowerShell Windows

Pasted image 20260925134101.png

I. Executive Summary

In previous lab entries, I utilized Wazuh to aggregate network, endpoint, and application telemetry. To test these detection capabilities, I investigated a simulated, multi-stage DNS exfiltration incident on a Windows endpoint.

I correlated the events on Wazuh to track the adversary's abuse of Windows binaries. The alerts also guided me in collecting forensic evidence and breaking down the complete attack chain from the initial phishing lure to data exfiltration and persistence.

Pasted image 20260915113944.png

II Attack Chain Overview (MITRE ATT&CK)
Tactics Technique Implementation Summary
Initial Access Phishing (T1566) Utilized phishing campaign to lure the target into downloading and opening the Q3_Bonus_Payout.pdf.lnk
Execution PowerShell (T1059.001) Utilized PowerShell to execute the attack chain.
Stealth Double File Extension (T1036.007) Masqueraded the .lnk payload by using double file extension .pdf.lnk.
Command Obfuscation (T1027.010) Obfuscated some commands with Base64 then decoded it during execution.
File Deletion (T1070.004) Removed the main exfiltration payload after it was executed.
Discovery System Owner/User Discovery (T1033) Used whoami to identify the currently logged in user.
System Network Configuration Discovery (T1016) Used ipconfig /all to look for network configuration such as IP and MAC address.
Collection Automated Collection (T1119) Used Get-ChildItem -Recurse to get the list of .csv files on the specified folder.
Archive via Utility (T1560.001) Compressed all .csv files into a single .zip file before exfiltration.
Local Data Staging (T1074.001) Staged the archived data on the user's Temp folder.
Exfiltration Automated Exfiltration (T1020) Looped Resolve-DnsName to perform exfiltration
Data Transfer Size Limits (T1030) Set the Base64 data payload to 45-character chunks per label staying within 63-character FQDN label limit.
Exfiltration Over Alternative Protocol (T1048) Exfiltrated the data using DNS protocol by performing NULL resource record type queries
Persistence Boot or Logon Autostart Execution (T1547) Modified the registry HKCU\...\Run to run a command on user login.
III. Incident Analysis and Alert Correlation
3.1 Initial Access

The attacker used a GitHub Repository to host their malicious staging and exfiltration scripts. The attack chain started when the victim opened a disguised shortcut file (Q3_Bonus_Payout.pdf.lnk), likely delivered via phishing.

3.2 Execution Chain

After the user opened Q3_Bonus_Payout.pdf.lnk, a series of PowerShell scripts executed in the background, ultimately leading to data exfiltration and persistence.

  1. Phase 1 - Staging
    • Downloads the main payload (exfil.ps1) to the disk and executes it in a new process.
    • Deletes exfil.ps1 from the disk to evade detection once execution is completed.
  2. Phase 2 - Exfiltration
    • Collects all .csv files in the specified path and compresses them into a single .zip archive.
    • Encodes the .zip archive into Base64 strings and exfiltrates the data in chunks using DNS queries.
  3. Phase 3 - Discovery & Persistence
    • Executes whoami and ipconfig /all to gather host and network information.
    • Adds a registry key (HKCU\...\Run) that triggers a hidden PowerShell task upon user login.
IV. Findings
  • The adversary used a masqueraded .lnk shortcut file delivered likely via phishing, which initiated the attack upon user interaction.
  • The threat actor initiated the stager in memory while exfil.ps1 was saved on disk. They obfuscated some payloads with Base64 encoding, and deleted artifacts from the disk after the attack was executed.
  • Host reconnaissance and collection were highly targeted. The script specifically enumerated and compressed .csv files located within the user's ~\Documents\Data\Datasets directory, limiting the immediate blast radius to that specific dataset.
  • The endpoint transmitted encoded data through DNS queries to the external domain by chunking the compressed .zip file into Base64 strings and tunneling it through DNS NULL queries.
  • The attacker deployed persistence by modifying the HKCU\...\Run registry key, ensuring their payload would re-execute upon subsequent user login.

V. Lessons Learned

  • Wazuh cannot flag every malicious event, defenders must also be able to investigate events that do not generate alerts by using the context available across logs, processes, and endpoint artifacts.
  • Cyber attacks usually goes through multiple phases to avoid detections and perform advanced exploitations, these also create multiple opportunities for defenders to thwart the intrusion and prevent further compromise.
  • Attackers can use sleep to delay malware executions to prevent noticeable security alert spikes and closely tied alerts. This requires the defenders to rely on PID/PPID/GUID to map process execution chains.
  • PowerShell Script Block Logging (4104) was able to capture a Base64-encoded payload (collection and archiving) after it was decoded during execution.
References