The built-in resolver forwards queries for any external domain, so a compromised resource can encode data in DNS queries to a domain it controls even when other outbound traffic is blocked. Data leaves the network without traversing the filtered egress path, impacting the confidentiality of data.
DNS Queries are Used as a Covert Exfiltration Channel
CCC.VPC.TH12
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.VPC.CP14 | Built-in DNS Resolution | The service automatically resolves hostnames to IP addresses for resources within the virtual network, allowing resources to communicate using hostnames instead of IP addresses. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.VPC.CN09 | Filter and Log DNS Queries | Ensure that the built-in resolver refuses queries to blocked domains and records every query, so that DNS cannot be used as an unobserved exfiltration channel. |