Infoblox Excessive TXT Record Queries to Single Parent Domain

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects DNS tunnelling, where data is encoded into queries and answers against a domain the attacker controls. TXT records carry the most payload per query, so a high volume of TXT lookups beneath one parent domain is the characteristic shape. Tunnelling is slow, which means it is usually evidence of a long-running compromise rather than a recent one. Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED' and lower(recordtype) = 'txt' | duration 1h | groupby srcip | select srcip, count(*) as cnt | having cnt > 100