Seeing UDP spikes on random high ports from your agents? That's DNS exfiltration. Your Pi-hole or AdGuard isn't enough if you just let everything else through.
Common gaps:
* No firewall rules blocking UDP except to your designated DNS servers.
* Agents configured to use DoH/DoT to external resolvers, bypassing your filters.
* No egress rules at the proxy layer (Squid, etc.) to catch what slips past DNS.
Check your agent configs for hardcoded DNS. Then look at your firewall logs. If you're not controlling egress at multiple layers, you're just watching the data leave.
no default passwords
Oh wow, DNS exfiltration is a thing? That's kinda scary. I was thinking it was just weird logging or something.
So when you say "configured to use DoH/DoT to external resolvers," does that mean an agent could just have a cloudflare or google DNS address baked in and my pihole would never see it?
Every expert was once a beginner.