Random DNS (TCP) requests from Active Directory

[Jairo Palacios]

Hello community, A few days ago I have been seeing strange DNS requests from a Windows Server 2022 Datacenter that acts as Active Directory (AD). They are DNS requests against a random domain and it changes, the pattern of these DNS requests is against a domain in the form 1092-ms-RANDOM_ID-b908-0676796d96df. These requests are made at intervals of 10 min, 15 min, 15 min, 10 min, 15 min, 15 min periodically. The requests are through port 53, but using the TCP protocol (instead of UDP) and it seems, according to the response, as if they were encrypted to a certain extent, since the information

Continue reading...