Wiki › Techniques, Tactics & Procedures (TTPs) › Command & Control › DNS-Based Command and Control

DNS-Based Command and Control

3 min read

Jump to:

Overview

DNS-Based Command and Control (DNS C2) is a technique where adversaries use the Domain Name System (DNS) protocol to communicate with compromised systems. It plays a critical role in the Command & Control stage of the attack lifecycle, enabling attackers to maintain stealthy and resilient control channels over infected hosts. Adversaries leverage DNS due to its ubiquity, ease of evasion, and the difficulty defenders face in distinguishing malicious DNS traffic from legitimate queries.

Attack Objective

Establish and maintain covert communication channels for remote control and data exchange
Primarily supports the Command & Control stage, but can also facilitate Execution, Persistence, and Exfiltration
Advances attacker position by enabling stealthy instructions delivery, data retrieval, and operational flexibility without raising immediate suspicion

How the Technique Works

Adversaries encode command instructions, responses, or data within DNS queries and responses, exploiting DNS’s hierarchical and distributed nature. Compromised hosts send DNS requests to attacker-controlled domains, which respond with encoded payloads or commands. This communication can use various DNS record types (e.g., TXT, A, CNAME) and often involves data encoding schemes to evade detection. The technique leverages the fact that DNS traffic is typically allowed through firewalls and monitored less rigorously than other protocols.

Common Methods & Variations

Use of DNS TXT records to transmit commands or data in text form
Encoding data within subdomains of DNS queries (e.g., data exfiltration via DNS request names)
Employing DNS tunneling to create bidirectional communication channels
Variants targeting on-premises networks, cloud environments, or hybrid infrastructures
Use of living-off-the-land tools such as native DNS query utilities versus custom malware implementing DNS communication

Indicators of Compromise (IOCs)

Unusual DNS query patterns, including high volume or irregular domain name structures
DNS requests to domains with low reputation or newly registered domains
Frequent DNS queries containing encoded or non-human-readable subdomains
Unexpected DNS record types or anomalous response sizes
Endpoint logs showing DNS query executions by uncommon processes

Detection Strategies

Monitoring DNS traffic logs and network telemetry for anomalies in query frequency, domain entropy, and uncommon record types
Behavioral detection focusing on patterns of DNS requests inconsistent with normal user or system behavior
Correlation of DNS activity with endpoint process execution and network connections
Use of threat intelligence feeds to identify known malicious domains or DNS infrastructures

Mitigation & Prevention

Implement DNS filtering and blocking of known malicious or suspicious domains
Enforce strict egress filtering and limit DNS queries to authorized resolvers
Deploy network segmentation to restrict DNS traffic and reduce attack surface
Apply least privilege principles to limit processes capable of generating DNS queries
Use DNS security extensions (DNSSEC) and monitoring tools to detect anomalous DNS activity

Response Considerations

Immediately isolate affected systems to disrupt DNS C2 channels
Analyze DNS logs and network captures to identify command patterns and scope of compromise
Identify and block attacker-controlled domains at the network perimeter
Perform endpoint forensics to understand malware persistence and lateral movement
Harden DNS configurations and update detection rules to prevent recurrence

Related Techniques

Data Encoding in DNS queries and responses
DNS Tunneling for covert data exfiltration
Use of Commonly Allowed Ports for C2 communication
Living-off-the-Land Binaries for execution of DNS queries

Mapping & References

MITRE ATT&CK Tactic: Command and Control
MITRE ATT&CK Technique: T1071.004 – Application Layer Protocol: DNS
Public research on DNS tunneling and DNS-based malware communication
Security advisories on detection and mitigation of DNS C2 channels

Tags: Attack Lifecycle Command and Control Cybersecurity Techniques DNS Malware Communication network security Threat Detection TTPs