DNS
Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication...
BY SOURCE
PROCEDURES (23)
Auto-extracted: 3 detections for beacon
Auto-extracted: 2 detections for cloud monitoring
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for command and control
Auto-extracted: 2 detections for c2
Auto-extracted: 2 detections for email
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for phish
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for general monitoring