# DNS Tunnelling Detection (lab)

> A law firm mid-transaction under a confidentiality undertaking. Overnight operations noticed DNS volume was up and logged a low-priority ticket.

Canonical: https://codelivly.com/labs/dns-tunnelling

| | |
|---|---|
| Type | Investigation |
| Difficulty | Intermediate |
| Points | 350 |
| Session length | 45 min |
| Completions | 1 |

A law firm mid-transaction under a confidentiality undertaking. Overnight operations noticed DNS volume was up and logged a low-priority ticket. A previous reviewer ran the firm's standard hunting query, found nothing, and closed it. Work out whether data is leaving this network — and if so, how much.

## Objective

Learn to find a covert channel that the standard domain-generation hunting technique cannot see. You will group resolver logs by parent domain, count distinct client hosts per domain, measure outbound payload from query-name length and inbound payload from answer size, and separate a real exfiltration channel from an approved security product whose traffic looks the same on every naive measure.

## Tasks

1. Reproduce the review that closed the ticket
2. Group by parent domain, not by name
3. Check the approved-services list before accusing anything
4. Measure both directions
5. Scope it and report

## Related

- [All labs](https://codelivly.com/practice?type=lab)