CmdID

CmdID / Techniques / T1071

T1071.004 Application Layer Protocol: DNS

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. MITRE ATT&CK

3 Sigma rules T1071.004 on attack.mitre.org

Part of

MITRE ATT&CK
T1071Application Layer Protocol

Sigma rules tagged with it

process creation, the highest levels first
criticalOilRig APT ActivityFlorian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community · Windows
highDNS Exfiltration and Tunneling Tools ExecutionDaniil Yugoslavskiy, oscd.community · Windows
mediumNslookup PowerShell Download Cradle - ProcessCreationNasreddine Bencherchali (Nextron Systems) · Windows