Which technique obfuscates malicious traffic by carrying it within common protocols in legitimate traffic?

Which technique obfuscates malicious traffic by carrying it within common protocols in legitimate traffic?

• A. HTTP User Agent Detection
• B. Use of DNS Tunneling
• C. Data Staging
• D. Command and Control Server Detection

Answer: (B)

Hiding malicious traffic inside ordinary protocol communications creates a covert channel. DNS tunneling does exactly this by packing data into DNS queries and responses. Because DNS traffic is usually allowed through networks and often not scrutinized deeply, an attacker can exfiltrate data or maintain a command-and-control channel by encoding information in subdomain labels or DNS TXT records, making the traffic appear legitimate while carrying malicious payloads. Defenders look for signs like unusual or high-entropy subdomains, long or abnormal DNS query strings, and atypical DNS response patterns. Other options don’t describe this method: HTTP User Agent detection targets client identifiers rather than hiding traffic; data staging concerns preparing data for exfiltration; and command-and-control server detection is about finding the C2 host, not the technique of tunneling traffic through a common protocol.

Hiding malicious traffic inside ordinary protocol communications creates a covert channel. DNS tunneling does exactly this by packing data into DNS queries and responses. Because DNS traffic is usually allowed through networks and often not scrutinized deeply, an attacker can exfiltrate data or maintain a command-and-control channel by encoding information in subdomain labels or DNS TXT records, making the traffic appear legitimate while carrying malicious payloads. Defenders look for signs like unusual or high-entropy subdomains, long or abnormal DNS query strings, and atypical DNS response patterns. Other options don’t describe this method: HTTP User Agent detection targets client identifiers rather than hiding traffic; data staging concerns preparing data for exfiltration; and command-and-control server detection is about finding the C2 host, not the technique of tunneling traffic through a common protocol.