Threat Hunt · Exfil · Threat Hunt
Law firm DNS tunneling exfil · 8 GB of client files leaked over 3 months
An anomalous DNS query pattern was detected on the firewall of a high-end law firm. One endpoint makes 12,000 TXT record queries per day · subdomain pattern: 60-char random (base64-like). 8 GB of client files leaked over 3 months. The KVKK 72-hour clock has started. You will make 11 critical decisions in sequence.
Before you start the scenario
- You are the decision-maker in this incident · every choice leaves time/cost/reputation behind
- There are no wrong answers · just like in real life · but some paths are more expensive
- You can restart it anytime · try different paths
- At the end, a 3-axis score + alternative routes are shown