1200KM / detection
T0869.001 DNS — Detection Rules
Detection workspace for T0869.001 DNS: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0934 Behavioral Detection of DNS Protocol Misuse for Command and Control
AN2099 Analytic 2099
Real-time monitoring identifies an ICS Windows asset bypassing designated DNS resolvers, generating tunneling-like DNS content, or establishing HTTPS/TLS sessions to unapproved DoH resolver/API infrastructure from a process not authorized for encrypted DNS. Require a resolver-policy or asset-role violation plus suspicious query/content/process/destination evidence; suppress approved browsers, security products, vendor cloud services, and documented maintenance.
AN2097 Analytic 2097
Real-time monitoring identifies ICS clients sending DNS directly to unauthorized resolvers, native DNS with tunneling characteristics, or HTTPS/TLS connections to known/identified DoH infrastructure that bypass the site resolver/proxy architecture. Alert on policy violation plus content/flow corroboration; do not alert solely on high DNS volume.
AN2098 Analytic 2098
Real-time monitoring identifies a Linux ICS asset bypassing designated DNS resolvers, producing tunneling-like native DNS, or connecting to unapproved DoH/DoT infrastructure from an unauthorized process/service. Require resolver-policy or asset-role violation plus corroborating process, query, or destination evidence; suppress approved package/vendor/security workflows.
AN2096 Analytic 2096
Real-time monitoring identifies an embedded OT/IoT device sending DNS to a resolver not defined for its role, tunneling-like native DNS, or direct HTTPS/TLS to an unapproved DoH endpoint. Because many embedded devices have fixed communications, require deviation from the device-specific resolver/destination profile and corroborating query or destination evidence.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T0869.001 simulation workspace
No reviewed association in this snapshot.
Existing anomaly research
Complete technique engineering workbook
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.