Google Cloud DNS Query and Response Logs

Location

Description

DNS telemetry for Google Cloud managed zones and Cloud DNS features, including query/response activity and operational signals about resolver behavior when logging is enabled.

Forensic Value

Cloud DNS logs help identify workload resolution of attacker domains, DNS-based C2, and data-exfiltration patterns originating from cloud workloads that never traverse on-premises DNS infrastructure.

Tools Required

Collection Commands

Cloud DNS > relevant zone or policy > Monitoring/Logging > export DNS activity and confirm the logging configuration for the investigation window

gcloud dns managed-zones describe <zone-name> --format=json > gcp_dns_zone_config.json

Collection Constraints

• •DNS evidence quality depends on Cloud DNS logging being enabled for the zones or policies that served the workloads in scope.
• •DNS logs establish resolution activity but do not prove the full application-layer transaction that followed.

MITRE ATT&CK Techniques

References