T1071.004sub-technique of T1071 Application Layer Protocol
DNS
ESXi · Linux · macOS · Network Devices · Windows4 pieces on this siteT1071.004 on attack.mitre.org
Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Sigma network pack: four rules for DNS, proxy and firewall logs
Long DNS labels, scripting-engine user agents at the proxy, executables fetched from a bare IP address, and SMB leaving the network. Written for the log sources most estates already collect and rarely alert on.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
DNS with something in the labels: a small constructed capture
Sixty DNS queries from one workstation, fifteen of them TXT lookups whose first label is 56 characters of base32. Small enough to read packet by packet, and generated by a script, so nothing in it came from a real network.
Read
Analyses, case studies, guides, references and interview questions.
Case study: the update was signed, and that was the problem
A trusted software update that carried a backdoor, worked as a case. Signing proved the build was the vendor's; it proved nothing about what was in it. Eight questions on detection, scope and the uncomfortable part, which is that nothing your endpoint controls were watching for was wrong.
Finding DNS tunnelling in a 4 GB capture without a signature
Entropy, subdomain cardinality and query-rate shape. Three statistics that find a covert channel faster than any rule matching a known tool.
how MITRE says to see it
Behavioral Detection of DNS Tunneling and Application Layer Abuse
- Detects high-frequency or anomalous DNS queries initiated by non-browser, non-system processes (e.g., PowerShell, rundll32, python.exe) used to establish command and control via DNS tunneling.
- Detects local daemons or scripts generating outbound DNS queries with long or frequent subdomains, indicative of DNS tunneling via tools like `iodine`, `dnscat2`, or `dig` from cronjobs or reverse shells.
- Detects scripting environments (AppleScript, osascript, curl) or non-native tools performing DNS queries with encoded subdomains, often used for data exfiltration or beaconing.
- Detects clients issuing DNS queries with high volume, long subdomain lengths, encoded payload patterns, or to known malicious infrastructure; indicative of DNS-based C2 channels.
what reduces it
- M1031 Network Intrusion Prevention. Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
- M1037 Filter Network Traffic. Consider filtering DNS requests to unknown, untrusted, or known bad domains and resources. Resolving DNS requests with on-premise/proxy servers may also disrupt adversary attempts to conceal data within DNS packets.