Unusual TXT Traffic
A roomy record type, used oddly
TXT records hold arbitrary text, which makes them essential for legitimate things like mail authentication — and attractive to anyone who needs a spacious channel. Here one client's TXT volume climbs far above everyone else's.
- TXT records are normal and necessary, mostly for SPF, DKIM and domain verification
- Proportion matters far more than presence
- Which host is asking, and how often, is the real signal
Queries/minRate across all simulated clients in this scenario.
60
AllowedLookups the simulated resolver answered normally.
1
BlockedLookups a policy or feed prevented.
0
FindingsDetections raised by the simplified demonstration model.
0
NXDOMAIN %Share of lookups for names that do not exist.
0.0%
Unique domainsDistinct names seen — high cardinality is itself a signal.
1
TXT queriesTXT and NULL lookups. Normal in small amounts.
0
Avg entropyBits per character of the leftmost label. Readable names sit near 2.5.
2.81
Query flow
How each simulated lookup is handled
Device
DEMO-DESKTOP-02
DNS query
A storage.example.net
DNS Daddy
resolver + policy
Signals
0 of 4 firing
Outcome
Allow
Event stream
Synthetic queries. Select a row to inspect it.
| Time | Device | Type | DNS query | Result |
|---|---|---|---|---|
| 13:42:00 | DEMO-DESKTOP-02192.0.2.32 | storage.example.net | Allowed |
Devices on the simulated network
Per-device behaviour, measured over the run
DEMO-LAPTOP-01192.0.2.21
Staff laptop
- queries
- 0
- unique
- 0
- entropy
- 0.00
- nxdomain
- 0%
DEMO-DESKTOP-02192.0.2.32
Reception desktop
- queries
- 1
- unique
- 1
- entropy
- 2.81
- nxdomain
- 0%
DEMO-LAB-CLIENT192.0.2.42
Isolated lab host
- queries
- 0
- unique
- 0
- entropy
- 0.00
- nxdomain
- 0%
DEMO-PHONE-04192.0.2.70
Mobile device
- queries
- 0
- unique
- 0
- entropy
- 0.00
- nxdomain
- 0%
DEMO-NAS-05192.0.2.91
File server
- queries
- 0
- unique
- 0
- entropy
- 0.00
- nxdomain
- 0%
Detection model
Signals accumulate as behaviour changes
Signals
- TXT queries dominate this client+0 of 28not yet observed
- High absolute TXT volume+0 of 20not yet observed
- Random-looking names carrying the TXT queries+0 of 22not yet observed
- Names almost never repeat+0 of 15not yet observed
Simplified demonstration model. Each signal adds a fixed number of points; reaching 65 generates a finding. Real detection engines weigh signals dynamically — this version is written to be readable, and is not production telemetry.
Attack timeline
How the scenario unfolds
- 1Mixed baseline traffic, occasional legitimate TXT lookupsnow
- 2One client's TXT proportion starts to rise
- 3Names carrying the TXT queries turn random-looking
- 4Volume and entropy signals fire
- 5Risk score crosses the threshold
- 6Finding generated
- 7Analyst checks the host's role before escalating
Threat hunting mode
Find the affected device before the model tells you
Hunting mode hides the finding and the highlighted device. You read the raw stream and per-device measurements, then name the device you think is compromised.
Keep going
Compare this against another pattern