DNS tunneling
A technique for smuggling data or C2 traffic through DNS queries — by encoding the information in subdomain names and responses. It exploits the fact that DNS is almost always let through firewalls, even in otherwise locked-down networks.
Mechanic: the attacker controls an authoritative DNS server for a domain. The compromised machine encodes data (exfiltrated files, C2 commands) in DNS queries — e.g. [base32-encoded-data].attacker.com — and the server responds with data encoded in TXT/other records. Since DNS is rarely blocked or inspected (everything needs name resolution) it becomes a reliable covert channel even where all other outbound traffic is barred. Downside for the attacker: slow (small amounts of data per query) and noisy if you exfiltrate a lot → it's often used for C2/small amounts, not large data leaks. Defense: monitor abnormally high DNS query volumes, unusually long/random subdomains, and queries to newly registered domains; DNS inspection and logging. A classic way to bypass network segmentation. Related to data exfiltration and command-and-control.