Threat Hunting Use Case: Firewall Targeting DNS

**Firewall Targeting DNS – Threat Hunting Use Case**: This blog post describes a threat-hunting use case that reviews firewall DNS traffic to detect and remediate risks such as DNS-based exfiltration (mapped to MITRE techniques T1048 and T1571), outlines log source requirements (application/protocol-aware firewall allow/deny logs), suggested 30–90 day duration, baseline/hygiene checks, and threat analysis steps (uncommon port usage, geo/IP filtering, large outbound flows, OSINT correlation), and recommends restricting outbound DNS (port 53) to authorized resolvers and improving firewall rule granularity.