Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Network Devices, Windows
Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the…
Sub-technique of Application Layer Protocol (T1071).
Sigma detection rules (5)
T1071.004 Application Layer Protocol: DNS
title: "T1071.004 Application Layer Protocol: DNS"
id: f7821b45-a76a-4c04-a424-76c5c9491d6f
description: 'Behavioral Detection of DNS Tunneling and Application Layer Abuse. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: QueryLengthThreshold, ProcessImageFilter, TimeWindow.'
references:
- https://attack.mitre.org/techniques/T1071/004
author: Shahrukh Khan
date: 2026-04-14
license: MIT
tags:
- attack.command-and-control
- attack.t1071.004
logsource:
category: dns_query
product: windows
service: sysmon
detection:
selection:
EventID: 22
selection_tunneling_indicators:
QueryName|re: '^[a-zA-Z0-9+/=_-]{50,}\..+'
filter_system_account:
User|contains:
- 'SYSTEM'
- 'LOCAL SERVICE'
- 'NETWORK SERVICE'
condition: selection and selection_tunneling_indicators and not filter_system_account
falsepositives:
- Legitimate services that use long encoded subdomain labels (some CDN edge-node lookups, software update/telemetry endpoints, certain SaaS health checks); tune the QueryName length threshold and add domain allowlists if noise remains.
level: medium
T1071.004 Application Layer Protocol: DNS
title: "T1071.004 Application Layer Protocol: DNS"
id: c7283f18-5fba-461f-bf90-3b48f19a5d87
description: 'True DNS-tunneling/C2-over-DNS detection (query-length, subdomain-entropy, TXT/NULL-record ratio, per-domain query volume) requires DNS payload content that auditd cannot see - auditd only observes socket-layer syscalls, not application-layer DNS query content. This rule instead implements the closest auditd-observable proxy: a process making raw outbound connections to port 53 (via SYSCALL connect/sendto correlated with the SOCKADDR record) that is not one of the systems recognized resolver binaries/services, consistent with a program implementing its own DNS-tunneling client rather than shelling out to dig/nslookup/host (which the prior version incorrectly flagged as the indicator itself). Tune using: SubdomainEntropyScore, DaemonAllowList.'
references:
- https://attack.mitre.org/techniques/T1071/004
author: Shahrukh Khan
date: 2026-03-18
license: MIT
tags:
- attack.command-and-control
- attack.t1071.004
logsource:
category: network_connection
product: linux
service: auditd
detection:
selection_syscall:
type: 'SYSCALL'
syscall:
- 'connect'
- 'sendto'
success: 'yes'
selection_port:
type: 'SOCKADDR'
saddr|contains: '0035'
filter_known_resolvers:
exe|endswith:
- '/dig'
- '/nslookup'
- '/host'
- '/systemd-resolved'
- '/dnsmasq'
- '/named'
- '/unbound'
condition: selection_syscall and selection_port and not filter_known_resolvers
falsepositives:
- Any legitimate application performing its own DNS resolution instead of via getaddrinfo/libresolv/local resolver (uncommon custom clients, some VPN or security tooling); confirming tunneling vs. legitimate direct DNS still requires query-content/entropy analysis (SubdomainEntropyScore) not available at the auditd layer.
level: medium
T1071.004 Application Layer Protocol: DNS
title: "T1071.004 Application Layer Protocol: DNS"
id: ecc8b697-83fe-448f-88f8-af3267c3bf4f
description: 'Behavioral Detection of DNS Tunneling and Application Layer Abuse. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: EntropyThreshold, UncommonProcessContext.'
references:
- https://attack.mitre.org/techniques/T1071/004
author: Shahrukh Khan
date: 2026-05-23
license: MIT
tags:
- attack.command-and-control
- attack.t1071.004
logsource:
category: network_connection
product: macos
detection:
selection:
DestinationPort: 53
Image|endswith:
- '/bash'
- '/zsh'
- '/python3'
condition: selection
falsepositives:
- Legitimate DNS troubleshooting utilities and custom scripts generate direct port 53 connections from shell or python processes; domain entropy is not observable in connection metadata alone.
level: medium