1. Home
  2. Techniques
  3. Enterprise
  4. Application Layer Protocol
  5. DNS

Application Layer Protocol: DNS

ID Name
T1071.001 Web Protocols
T1071.002 File Transfer Protocols
T1071.003 Mail Protocols
T1071.004 DNS

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.[1][2]

ID: T1071.004
Sub-technique of:  T1071
ⓘ
Tactic: Command and Control
ⓘ
Platforms: Linux, Windows, macOS
Contributors: Jan Petrov, Citi
Version: 1.0
Created: 15 March 2020
Last Modified: 21 October 2020
Provided by LAYER 8

Procedure Examples

ID Name Description
S0504 Anchor

Variants of Anchor can use DNS tunneling to communicate with C2.[3][4]
G0026 APT18

APT18 uses DNS for C2 communications.[5]
G0087 APT39

APT39 has used remote access tools that leverage DNS in communications with C2.[6]
G0096 APT41

APT41 used DNS for C2 communications.[7][8]

S0360 BONDUPDATER

BONDUPDATER can use DNS and TXT records within its DNS tunneling protocol for command and control.[9]
G0114 Chimera

Chimera has used Cobalt Strike to encapsulate C2 in DNS traffic.[10]
G0080 Cobalt Group

Cobalt Group has used DNS tunneling for C2.[11][12][13]
S0154 Cobalt Strike

Cobalt Strike can use a custom command and control protocol that can be encapsulated in DNS. All protocols use their standard assigned ports.[14][15][16]

S0338 Cobian RAT

Cobian RAT uses DNS for C2.[17]
S0354 Denis

Denis has used DNS tunneling for C2 communications.[18][19][20]
S0377 Ebury

Ebury has used DNS requests over UDP port 53 for C2.[21]

G0046 FIN7

FIN7 has performed C2 using DNS via A, OPT, and TXT records.[22]
S0477 Goopy

Goopy has the ability to communicate with its C2 over DNS.[20]

S0170 Helminth

Helminth can use DNS for C2.[23]
S0070 HTTPBrowser

HTTPBrowser has used DNS for command and control.[24][25]
S0260 InvisiMole

InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies.[26]
G0004 Ke3chang

Ke3chang malware RoyalDNS has used DNS for C2.[27]
S0167 Matryoshka

Matryoshka uses DNS for C2.[28][29]
S0228 NanHaiShu

NanHaiShu uses DNS for the C2 communications.[30]
G0049 OilRig

OilRig has used DNS for C2 including the publicly available requestbin.net tunneling service.[31][32][33][34]
S0124 Pisloader

Pisloader uses DNS as its C2 protocol.[35]
S0013 PlugX

PlugX can be configured to use DNS for command and control.[24]
S0145 POWERSOURCE

POWERSOURCE uses DNS TXT records for C2.[36][37]
S0184 POWRUNER

POWRUNER can use DNS for C2 communications.[38][32]
S0269 QUADAGENT

QUADAGENT uses DNS for C2 communications.[39]
S0495 RDAT

RDAT has used DNS to communicate with the C2.[40]

S0125 Remsec

Remsec is capable of using DNS for C2.[41][42][43]
S0596 ShadowPad

ShadowPad has used DNS tunneling for C2 communications.[44]
S0633 Sliver

Sliver can support C2 communications over DNS.[45][46][47]
S0615 SombRAT

SombRAT can communicate over DNS with the C2 server.[48][49]
S0157 SOUNDBITE

SOUNDBITE communicates via DNS for C2.[50]
S0559 SUNBURST

SUNBURST used DNS for C2 traffic designed to mimic normal SolarWinds API communications.[51]
S0146 TEXTMATE

TEXTMATE uses DNS TXT records for C2.[36]
G0081 Tropic Trooper

Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.[52]

S0514 WellMess

WellMess has the ability to use DNS tunneling for C2 communications.[53][54]

Mitigations

ID Mitigation Description
M1037 Filter Network Traffic

Consider filtering DNS requests to unknown, untrusted, or known bad domains and resources. Resolving DNS requests with on-premise/proxy servers may also disrupt adversary attempts to conceal data within DNS packets.

M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Detection

ID Data Source Data Component
DS0029 Network Traffic Network Traffic Content
Network Traffic Flow

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards regarding syntax, structure, or any other variable adversaries could leverage to conceal data.[55]

Monitor for DNS traffic to/from known-bad or suspicious domains.

References

  1. Palo Alto Networks. (n.d.). What Is DNS Tunneling?. Retrieved March 15, 2020.
  2. Galobardes, R. (2018, October 30). Learn how easy is to bypass firewalls using DNS tunneling (and also how to block it). Retrieved March 15, 2020.
  3. Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.
  4. Grange, W. (2020, July 13). Anchor_dns malware goes cross platform. Retrieved September 10, 2020.
  5. Grunzweig, J., et al. (2016, May 24). New Wekby Attacks Use DNS Requests As Command and Control Mechanism. Retrieved November 15, 2018.
  6. Rusu, B. (2020, May 21). Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia. Retrieved May 22, 2020.
  7. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
  8. Rostovcev, N. (2021, June 10). Big airline heist APT41 likely behind a third-party attack on Air India. Retrieved August 26, 2021.
  9. Wilhoit, K. and Falcone, R. (2018, September 12). OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government. Retrieved February 18, 2019.
  10. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved January 19, 2021.
  11. Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.
  12. Positive Technologies. (2016, December 16). Cobalt Snatch. Retrieved October 9, 2018.
  13. Matveeva, V. (2017, August 15). Secrets of Cobalt. Retrieved October 10, 2018.
  14. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
  15. Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved April 6, 2021.
  16. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  17. Yadav, A., et al. (2017, August 31). Cobian RAT – A backdoored RAT. Retrieved November 13, 2018.
  18. Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018.
  19. Shulmin, A., Yunakovsky, S. (2017, April 28). Use of DNS Tunneling for C&C Communications. Retrieved November 5, 2018.
  20. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  21. M.Léveillé, M.. (2014, February 21). An In-depth Analysis of Linux/Ebury. Retrieved April 19, 2019.
  22. Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.
  23. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  24. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.
  25. Shelmire, A.. (2015, July 6). Evasive Maneuvers. Retrieved January 22, 2016.
  26. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
  27. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  28. ClearSky Cyber Security and Trend Micro. (2017, July). Operation Wilted Tulip: Exposing a cyber espionage apparatus. Retrieved August 21, 2017.
  1. Minerva Labs LTD and ClearSky Cyber Security. (2015, November 23). CopyKittens Attack Group. Retrieved September 11, 2017.
  2. F-Secure Labs. (2016, July). NANHAISHU RATing the South China Sea. Retrieved July 6, 2018.
  3. Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
  4. Davis, S. and Caban, D. (2017, December 19). APT34 - New Targeted Attack in the Middle East. Retrieved December 20, 2017.
  5. Bromiley, M., et al.. (2019, July 18). Hard Pass: Declining APT34’s Invite to Join Their Professional Network. Retrieved August 26, 2019.
  6. Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.
  7. Grunzweig, J., et al. (2016, May 24). New Wekby Attacks Use DNS Requests As Command and Control Mechanism. Retrieved August 17, 2016.
  8. Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017.
  9. Brumaghin, E. and Grady, C.. (2017, March 2). Covert Channels and Poor Decisions: The Tale of DNSMessenger. Retrieved March 8, 2017.
  10. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  11. Lee, B., Falcone, R. (2018, July 25). OilRig Targets Technology Service Provider and Government Agency with QUADAGENT. Retrieved August 9, 2018.
  12. Falcone, R. (2020, July 22). OilRig Targets Middle Eastern Telecommunications Organization and Adds Novel C2 Channel with Steganography to Its Inventory. Retrieved July 28, 2020.
  13. Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.
  14. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.
  15. Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.
  16. Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.
  17. NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.
  18. Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.
  19. BishopFox. (n.d.). Sliver DNS C2 . Retrieved September 15, 2021.
  20. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.
  21. McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.
  22. Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.
  23. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  24. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
  25. PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.
  26. National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.
  27. Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.