DNS Tunneling: Covert Exfiltration from One Host

A single workstation at Valkara Analytics has been leaking data all day through a DNS tunnel. Every query carries encoded payload chunks inside high-entropy subdomain labels to an attacker-controlled name server. Reconstruct the tunnel from resolver and firewall logs, identify the compromised host and the attacker's infrastructure, and map the technique to ATT&CK.