MITRE ATT&CKsub-technique

T1071.004 DNS

Published 2020-03-15 Modified 2026-09-03 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
1.4
Created
2020-03-15

Description

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. Protocol Tunneling). The commands may be embedded into different DNS records, for example, TXT or A records. DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices. Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1071 Application Layer Protocol technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1037 Filter Network Traffic mitigation
  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (56)

  • S9050 Vidar software (malware)
  • S9015 BRICKSTORM software (malware)
  • S9001 SystemBC software (malware)
  • C0029 Cutting Edge campaign
  • S1111 DarkGate software (malware)
  • S1090 NightClub software (malware)
  • S1063 Brute Ratel C4 software (tool)
  • S1047 Mori software (malware)
  • S1027 Heyoka Backdoor software (malware)
  • S1021 DnsSystem software (malware)
  • S1020 Kevin software (malware)
  • S1019 Shark software (malware)
  • G1003 Ember Bear group
  • S1015 Milan software (malware)
  • S1014 DanBot software (malware)
  • S0699 Mythic software (tool)
  • S0690 Green Lambert software (malware)
  • S0666 Gelsemium software (malware)
  • S0663 SysUpdate software (malware)
  • G0140 LazyScripter group
  • S0633 Sliver software (tool)
  • S0615 SombRAT software (malware)
  • S0596 ShadowPad software (malware)
  • S0559 SUNBURST software (malware)
  • S0514 WellMess software (malware)
  • S0504 Anchor software (malware)
  • G0114 Chimera group
  • S0495 RDAT software (malware)
  • S0477 Goopy software (malware)
  • G0096 APT41 group
Show all 56 ›

Referenced by Compliance · mitigates (24)

  • CIS-13.10 Perform Application Layer Filtering CIS Safeguard v8.1
  • CIS-13.4 Perform Traffic Filtering Between Network Segments CIS Safeguard v8.1
  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-4.9 Configure Trusted DNS Servers on Enterprise Assets CIS Safeguard v8.1
  • CIS-9.2 Use DNS Filtering Services CIS Safeguard v8.1
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SC-10 Network Disconnect NIST 800-53 control
  • NIST-SC-20 Secure Name/Address Resolution Service (Authoritative Source) NIST 800-53 control
  • NIST-SC-21 Secure Name/Address Resolution Service (Recursive or Caching Resolver) NIST 800-53 control
  • NIST-SC-22 Architecture and Provisioning for Name/Address Resolution Service NIST 800-53 control
  • NIST-SC-23 Session Authenticity NIST 800-53 control
  • NIST-SC-31 Covert Channel Analysis NIST 800-53 control
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-15 Information Output Filtering NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References