T1071.004Command and Control
DNS
Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
18 Sigma rules tagged T1071.004DNST1071.00418 general rules
- Cobalt Strike DNS Beaconingcriticaltest
- OilRig APT Activitycriticaltest
- OilRig APT Registry Persistencecriticaltest
- OilRig APT Schedule Task Persistence - Securitycriticaltest
- OilRig APT Schedule Task Persistence - Systemcriticaltest
- Silence.EDA Detectioncriticaltest
- Suspicious Cobalt Strike DNS Beaconing - DNS Clientcriticaltest
- Suspicious Cobalt Strike DNS Beaconing - Sysmoncriticaltest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to DNS
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.