EXT-02 Extraction · Exfiltration & C2 KQL YARA

DNS Tunneling

Mappings

MITRE ATT&CK

T1071.004 Application Layer Protocol: DNS T1572 Protocol Tunneling

CVE examples

Not vulnerability-based — this capability is behavioural.

MalwareBazaar

Cobalt Strike

Summary

DNS Tunneling refers to the use of domain name system communication to transfer attacker-controlled data between a target environment and external systems by encoding information within DNS queries and responses. This includes embedding commands, system information, or file fragments into DNS traffic that appears consistent with routine network resolution activity. Within MalChain, this capability begins once data is transmitted through DNS communication channels in a manner that bypasses standard network monitoring controls. Attackers exploit implicit trust in DNS infrastructure and the necessity of domain resolution services to establish covert communication paths. Routine reliance on DNS traffic for system connectivity often allows encoded communication to occur without deep inspection. Trust abuse may involve sending encoded data through subdomain requests, receiving instructions through DNS responses, or maintaining communication sessions presented as legitimate domain resolution activity. Common tunneling methods include:

Encoding data within DNS query names
Transmitting commands through DNS response records
Using dynamically generated subdomains for communication
Fragmenting data into multiple DNS requests
Leveraging external DNS servers to relay information

Real world usage includes:

Covert command-and-control communication in intrusion campaigns
Data exfiltration from restricted or monitored networks
Persistent threats maintaining communication through firewall restrictions
Malware operations bypassing network security controls

Detection Guidance

Detection relies on monitoring DNS query behavior, domain resolution patterns, and communication anomalies associated with encoded traffic. Contextual correlation between DNS activity and system behavior is essential to reduce false positives.

Monitor unusually long or frequent DNS queries
Detect communication with rare or newly registered domains
Correlate DNS activity with unexpected data access patterns
Alert on repetitive DNS requests containing encoded content
Identify rare or unauthorized DNS communication patterns

KQL Detection Concepts

DNS query events involving high-frequency or irregular domain requests
Network traffic indicating large volumes of DNS communication
Queries containing unusually long or randomized subdomain strings

YARA Detection Concepts

Scripts or binaries implementing DNS communication routines
Code patterns associated with encoding data into DNS queries
Executable components interacting with DNS resolution mechanisms

KQL Detection Rule

kql

// DNS Tunneling: long / high-entropy subdomains and high query volume
DeviceNetworkEvents
| where Timestamp > ago(3d)
| where ActionType == "DnsQueryResponse" or isnotempty(RemoteUrl)
| extend Sub = tostring(split(RemoteUrl, ".")[0])
| where strlen(Sub) > 30
| summarize Queries=count(), MaxLen=max(strlen(Sub)) by DeviceName, Domain=strcat(tostring(split(RemoteUrl,".")[-2]),".",tostring(split(RemoteUrl,".")[-1])), bin(Timestamp,1h)
| where Queries > 100
| project Timestamp, DeviceName, Domain, Queries, MaxLen

YARA Detection Rule

yara

rule MC_EXT_02_DNS_Tunnel_Tooling
{
    meta:
        author = "MalChain"
        technique = "MC-EXT-02 DNS Tunneling"
        description = "Known DNS-tunnel tool markers / DNS TXT exfil routines"
    strings:
        $a = "iodine" ascii nocase
        $b = "dnscat" ascii nocase
        $c = "dns2tcp" ascii nocase
        $t = "DNS_TYPE_TXT" ascii
        $q = "DnsQuery_A" ascii
    condition:
        1 of ($a,$b,$c) or ($t and $q)
}