DNS tunneling
Data or commands encoded in DNS queries and responses
categoryNetwork and infrastructure attacksseverityHighdetectabilityHighlabnot yet measured
Detection opportunity what to watch for
A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.
What the attacker runs
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1071.004 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1071.004 -TestGuids fef31710-223a-40ee-8462-a396d6b66978 -TimeoutSeconds 120'Queued for lab measurement — not yet detonated.
Classification
27 values: 14 reviewed, 12 imported, 1 derived. What do these mean?
Exploitability
| Attack vector | Network attacks |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | Medium |
| Resources required | Low |
| Likelihood / prevalence | High |
| Maturity | Established |
Impact & scope
| Severity | High |
|---|---|
| Impact | Confidentiality |
| Platform | ESXiLinuxmacOSNetwork DevicesWindows |
| Environment | CloudOn-premises |
| Target asset class | Data storeNetwork device |
| Kill-chain phase (tactic) | Command and Control |
Detection & telemetry
| Detectability | High |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Network Connection CreationNetwork Traffic ContentNetwork Traffic FlowProcess Creation |
Detection & response
Mitigated by 30
- M1031 attack-mitigation
- M1037 attack-mitigation
D3-APCAd3fendD3-CAd3fendD3-CFd3fendD3-CMd3fendD3-CQd3fendD3-CSPPd3fendD3-DFd3fendD3-DNSALd3fendD3-DNSDLd3fendD3-DNSTAd3fendD3-FAd3fendD3-FEd3fendD3-FEVd3fendD3-FIMd3fendD3-FRDDLd3fendD3-LFPd3fendD3-NTCDd3fendD3-NTFd3fendD3-NTSAd3fendD3-OTFd3fendD3-PHDURAd3fendD3-PMADd3fendD3-RFd3fendD3-RFAMd3fendD3-RPAd3fendD3-RRIDd3fendD3-RTSDd3fendD3-UGLPAd3fend
Detected by 18
- DET0400 attack-detection-strategy
0d18728b-f5bf-4381-9dcf-915539fff6c2sigma2975af79-28c4-4d2f-a951-9095f229df29sigma2fdaf50b-9fd5-449f-ba69-f17248119af6sigma3ceb2083-a27f-449a-be33-14ec1b7cc973sigma4153a907-2451-4e4f-a578-c52bb6881432sigma53ba33fd-3a50-4468-a5ef-c583635cfa92sigma6b0c762f-0e1b-435f-a829-5943b08fe36asigma7bdf2a7c-3acc-4091-9581-0a77dad1c5b5sigma8ae51330-899c-4641-8125-e39f2e07da72sigma98a96a5a-64a0-4c42-92c5-489da3866cb0sigma9c3d6e32-f4c8-4d73-8b8f-95c3b383a13csigmac0580559-a6bd-4ef6-b9b7-83703d98b561sigmac082c2b0-525b-4dbc-9a26-a57dc4692074sigmace6e34ca-966d-41c9-8d93-5b06c8b97a06sigmacf5ee356-65c4-4556-8d11-6977fcdfed4bsigmaf356a9c4-effd-4608-bbf8-408afd5cd006sigmaf8c1e80b-c73a-476a-ae24-6c72528b1521sigma
Tested by 4
1700f5d6-5a44-487b-84de-bc66f507b0a6atomic3efc144e-1af8-46bb-8ca2-1376bb6db8b6atomice7bf9802-2e78-4db9-93b5-181b7bcd37d7atomicfef31710-223a-40ee-8462-a396d6b66978atomic
Framework references
- Primary source: https://attack.mitre.org/techniques/T1071/
- attack: T1071.004 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Network and infrastructure attacks' table, line 173 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 55 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)