T1071.004 DNS — Detection Rules

Source-backed rule directory

• Cobalt Strike DNS Beaconing · test · critical · {"category":"dns"}
• Suspicious DNS Query with B64 Encoded String · test · medium · {"category":"dns"}
• DNS TXT Answer with Possible Execution Strings · test · high · {"category":"dns"}
• Suspicious Cobalt Strike DNS Beaconing - DNS Client · test · critical · {"product":"windows","service":"dns-client","definition":"Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events."}
• DNS Query To Common Malware Hosting and Shortener Services · experimental · medium · {"product":"windows","category":"dns_query"}
• DNS Query by Finger Utility · experimental · high · {"product":"windows","category":"dns_query"}
• Suspicious Cobalt Strike DNS Beaconing - Sysmon · test · critical · {"product":"windows","category":"dns_query"}
• Network Connection Initiated via Finger.EXE · experimental · high · {"category":"network_connection","product":"windows"}
• Silence.EDA Detection · test · critical · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• DNS Exfiltration and Tunneling Tools Execution · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1071.004 DNS

MATCH(dns_query_signature IN known_c2_patterns) OR COUNT(long_or_txt_queries BY source_host, 5m) >= threshold -> ALERT

• DNS Resolver Logs
• Packet-Capture Data
• Network Detection and Response Telemetry
• Atlas source section

Anomaly models

ATT&CK analytic guidance

DET0400 Behavioral Detection of DNS Tunneling and Application Layer Abuse

AN1121 Analytic 1121

Detects high-frequency or anomalous DNS queries initiated by non-browser, non-system processes (e.g., PowerShell, rundll32, python.exe) used to establish command and control via DNS tunneling.

AN1122 Analytic 1122

Detects local daemons or scripts generating outbound DNS queries with long or frequent subdomains, indicative of DNS tunneling via tools like `iodine`, `dnscat2`, or `dig` from cronjobs or reverse shells.

AN1123 Analytic 1123

Detects scripting environments (AppleScript, osascript, curl) or non-native tools performing DNS queries with encoded subdomains, often used for data exfiltration or beaconing.

AN1124 Analytic 1124

Detects clients issuing DNS queries with high volume, long subdomain lengths, encoded payload patterns, or to known malicious infrastructure; indicative of DNS-based C2 channels.

AN1125 Analytic 1125

Detects unusual outbound DNS traffic from ESXi hosts, often from shell scripts, custom daemons, or malicious VIBs interacting with external DNS infrastructure outside the management plane.