DNS Tunneling Identification and Defense

Domain Name Service (DNS) traffic freely travels across network perimeters and internal network segments. Organizations cannot arbitrarily block this UDP port 53 traffic because doing so would break most, if not all, network communication. Malicious actors (MA) know this and have found ways to exploit DNS for their purposes.
One example of how MA exploit DNS is tunneling. DNS tunneling enables command and control (C2) and data exfiltration traffic for which most organizations do not look or are unable adequately to detect.
This video explains how tunneling works, how to detect it, and how to manage it.

[@umerkha]

Excellent explanation, keep up the good stuff.

[@AdventuresinSecurity]

Much appreciated!

[@lanr3356]

loved the content. Thanks for sharing.

[@TheMadMagician87]

Great summary info, thanks.

[@AdventuresinSecurity]

Glad it was helpful!