Cross-source coverage

T1071.004 / ATT&CK

Application Layer Protocol: DNS

56 rules across 7 sources.

8 atomic-IOC hidden · include

From MITRE ATT&CK 19.2

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. Protocol Tunneling). The commands may be embedded into different DNS records, for example, TXT or A records. DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices. Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.

Tactics: Command and Control
Platforms: ESXi · Linux · macOS · Network Devices · Windows
Telemetry: WinEventLog:SysmonNSM:Flowauditd:SYSCALLmacos:unifiedlogesxi:syslogNSM:FLow

How MITRE says to detect it DET0400

Behavioral Detection of DNS Tunneling and Application Layer Abuse

Windows Analytic 1121

Detects high-frequency or anomalous DNS queries initiated by non-browser, non-system processes (e.g., PowerShell, rundll32, python.exe) used to establish command and control via DNS tunneling.

WinEventLog:Sysmon EventCode=3, 22
NSM:Flow dns.log

Linux Analytic 1122

Detects local daemons or scripts generating outbound DNS queries with long or frequent subdomains, indicative of DNS tunneling via tools like `iodine`, `dnscat2`, or `dig` from cronjobs or reverse shells.

auditd:SYSCALL execve
NSM:Flow dns.log

macOS Analytic 1123

Detects scripting environments (AppleScript, osascript, curl) or non-native tools performing DNS queries with encoded subdomains, often used for data exfiltration or beaconing.

macos:unifiedlog log stream 'eventMessage contains "dns_request"'

Network Devices Analytic 1124

Detects clients issuing DNS queries with high volume, long subdomain lengths, encoded payload patterns, or to known malicious infrastructure; indicative of DNS-based C2 channels.

NSM:Flow dns.log

ESXi Analytic 1125

Detects unusual outbound DNS traffic from ESXi hosts, often from shell scripts, custom daemons, or malicious VIBs interacting with external DNS infrastructure outside the management plane.

esxi:syslog /var/log/syslog.log
NSM:FLow dns.log

View on attack.mitre.org ↗

elastic/protections-artifacts

17 rules

Detection	Severity	Format
Connection to Dynamic DNS Provider by an Unsigned Binary	Undefined	Elastic TOML
Connection to Dynamic DNS Provider by a Signed Binary Proxy	Undefined	Elastic TOML
Connection to WebService by an Unsigned Binary	Undefined	Elastic TOML
Connection to WebService by a Signed Binary Proxy	Undefined	Elastic TOML
DNS Over HTTPS by an Unusual Process	Undefined	Elastic TOML
DNS Query to Suspicious Top Level Domain	Undefined	Elastic TOML
DNS Request by Recently Created Executable	Undefined	Elastic TOML
DNS Request by Suspicious Process Executable	Undefined	Elastic TOML
DNS Request to Crypto/DHT Services	Undefined	Elastic TOML
DNS Request to Crypto Miner Service	Undefined	Elastic TOML

+ 7 more from elastic/protections-artifacts → showing the 10 highest-severity

elastic/detection-rules

13 rules

Detection	Severity	Format
Machine Learning Detected DGA activity using a known SUNBURST DNS domain	High	Elastic TOML
Network Activity to a Suspicious Top Level Domain	High	Elastic TOML
System Public IP Discovery via DNS Query	High	Elastic TOML
Potential Command and Control via Internet Explorer	Medium	Elastic TOML
Potential DNS Tunneling via NsLookup	Medium	Elastic TOML
DNS Request to Suspicious Top Level Domain	Low	Elastic TOML
DNS Tunneling	Low	Elastic TOML
Machine Learning Detected a DNS Request Predicted to be a DGA Domain	Low	Elastic TOML
Machine Learning Detected a DNS Request With a High DGA Probability Score	Low	Elastic TOML
Potential DGA Activity	Low	Elastic TOML

+ 3 more from elastic/detection-rules → showing the 10 highest-severity

SigmaHQ/sigma

10 rules

Detection	Severity	Format
OilRig APT Activity	Critical	Sigma
OilRig APT Registry Persistence	Critical	Sigma
OilRig APT Schedule Task Persistence - Security	Critical	Sigma
OilRig APT Schedule Task Persistence - System	Critical	Sigma
Silence.EDA Detection	Critical	Sigma
Suspicious Cobalt Strike DNS Beaconing - DNS Client	Critical	Sigma
DNS Exfiltration and Tunneling Tools Execution	High	Sigma
DNS Query by Finger Utility	High	Sigma
DNS TXT Answer with Possible Execution Strings	High	Sigma
Network Connection Initiated via Finger.EXE	High	Sigma

splunk/security_content

9 rules

Detection	Severity	Format
DNS Kerberos Coercion	Undefined	SPL
Excessive DNS Failures	Undefined	SPL
Windows AI Platform DNS Query	Undefined	SPL
Windows Credential Target Information Structure in Commandline	Undefined	SPL
Windows DNS Query Request by Telegram Bot API	Undefined	SPL
Windows Kerberos Coercion via DNS	Undefined	SPL
Windows Powershell Commands from DNS TXT	Undefined	SPL
Windows Short Lived DNS Record	Undefined	SPL
Windows Visual Basic Commandline Compiler DNSQuery	Undefined	SPL

Wazuh Core Ruleset

4 rules

Detection	Severity	Format
Cisco eStreamer: APP-DETECT DNS request for potential malware	Medium	Wazuh XML
Amazon Security Lake - Route 53 - Failed DNS request for a Non-Existent Domain [] "" from . · query.type = \.*, rcode = NXDOMAIN	Low	Wazuh XML
Amazon Security Lake - Route 53 - Failed DNS request [] "" from . · query.type = \.*, rcode_id = -1	Low	Wazuh XML
Amazon Security Lake - Route 53 - Succsessful DNS request [] "" from . · query.type = \.*, rcode = NOERROR	Low	Wazuh XML

chainguard-dev/osquery-defense-kit

2 rules

Detection	Severity	Format
Catch DNS traffic going to machines other than the host-configured DNS server (event-based)	Undefined	osquery SQL
Catch DNS traffic going to machines other than the host-configured DNS server (state-based)	Undefined	osquery SQL

panther-labs/panther-analysis

1 rule

Detection	Severity	Format
DNS request to denylisted domain	High	Panther Python