EXPLORE
← Back to Explore
T1071.004

DNS

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication...

LinuxmacOSWindowsNetwork DevicesESXi
31
Detections
4
Sources
11
Threat Actors

BY SOURCE

12elastic10sigma8splunk_escu1crowdstrike_cql

PROCEDURES (23)

Beacon3 detections

Auto-extracted: 3 detections for beacon

Cloud Monitoring2 detections

Auto-extracted: 2 detections for cloud monitoring

Bypass2 detections

Auto-extracted: 2 detections for bypass

Service2 detections

Auto-extracted: 2 detections for service

Command And Control2 detections

Auto-extracted: 2 detections for command and control

C22 detections

Auto-extracted: 2 detections for c2

Email2 detections

Auto-extracted: 2 detections for email

Persist1 detections

Auto-extracted: 1 detections for persist

Credential1 detections

Auto-extracted: 1 detections for credential

Phish1 detections

Auto-extracted: 1 detections for phish

Credential1 detections

Auto-extracted: 1 detections for credential

Network Connection Monitoring1 detections

Auto-extracted: 1 detections for network connection monitoring

Remote1 detections

Auto-extracted: 1 detections for remote

C21 detections

Auto-extracted: 1 detections for c2

Command And Control1 detections

Auto-extracted: 1 detections for command and control

Script Execution Monitoring1 detections

Auto-extracted: 1 detections for script execution monitoring

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Download1 detections

Auto-extracted: 1 detections for download

Remote1 detections

Auto-extracted: 1 detections for remote

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Credential1 detections

Auto-extracted: 1 detections for credential

Service1 detections

Auto-extracted: 1 detections for service

General Monitoring1 detections

Auto-extracted: 1 detections for general monitoring

DETECTIONS (31)

Cobalt Strike DNS Beaconing
sigmacritical
DNS Exfiltration and Tunneling Tools Execution
sigmahigh
DNS Kerberos Coercion
splunk_escu
DNS Query by Finger Utility
sigmahigh
DNS Query To Common Malware Hosting and Shortener Services
sigmamedium
DNS Staging Detection: ClickFix-Inspired nslookup Execution
crowdstrike_cql
DNS Tunneling
elasticlow
DNS TXT Answer with Possible Execution Strings
sigmahigh
Excessive DNS Failures
splunk_escu
GenAI Process Connection to Suspicious Top Level Domain
elasticmedium
Machine Learning Detected a DNS Request Predicted to be a DGA Domain
elasticlow
Machine Learning Detected a DNS Request With a High DGA Probability Score
elasticlow
Machine Learning Detected DGA activity using a known SUNBURST DNS domain
elastichigh
Network Activity to a Suspicious Top Level Domain
elastichigh
Network Connection Initiated via Finger.EXE
sigmahigh
Potential Command and Control via Internet Explorer
elasticmedium
Potential DGA Activity
elasticlow
Potential DNS Tunneling via NsLookup
elasticmedium
Silence.EDA Detection
sigmacritical
Suspicious Cobalt Strike DNS Beaconing - DNS Client
sigmacritical
Suspicious Cobalt Strike DNS Beaconing - Sysmon
sigmacritical
Suspicious DNS Query with B64 Encoded String
sigmamedium
System Public IP Discovery via DNS Query
elastichigh
Unusual DNS Activity
elasticlow
Unusual Network Destination Domain Name
elasticlow
Windows AI Platform DNS Query
splunk_escu
Windows Credential Target Information Structure in Commandline
splunk_escu
Windows DNS Query Request by Telegram Bot API
splunk_escu
Windows Kerberos Coercion via DNS
splunk_escu
Windows Short Lived DNS Record
splunk_escu
Windows Visual Basic Commandline Compiler DNSQuery
splunk_escu