Goal

Detects DNS queries whose hostname contains base64 padding (==) indicating possible data encoded into a subdomain.

Strategy

This rule monitors OCSF DNS Activity events where @ocsf.class_uid is 4003 and @ocsf.query.hostname matches *==.*. The double-equals padding is produced by base64 encoders, and its presence inside a DNS label is unusual for legitimate hostnames. Attackers embed encoded command output, credentials, or confidential data into a subdomain so that the data is exfiltrated through DNS.

Triage and response

• Examine the hostname {{@ocsf.query.hostname}} and base64-decode the encoded label to determine whether it contains structured data such as credentials, file contents, or command output.
• Identify the workload on {{@ocsf.src_endpoint.ip}} that initiated the query and investigate potentially suspicious behavior
• Review the parent domain in the query for prior reputation hits, recent registration, or known association with DNS tunneling toolkits.
• Check whether additional encoded subdomains have been queried under the same parent, which would suggest active exfiltration
• Determine if outbound traffic to other channels (HTTP, HTTPS, ICMP) from the same host shows other suspicious activity.