Description
Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling)
DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. Protocol Tunneling). The commands may be embedded into different DNS records, for example, TXT or A records.(Citation: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government) DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.(Citation: DNS Beacons) Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.
Platforms
Mitigations (2)
Network Intrusion PreventionM1031
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.
Filter Network TrafficM1037
Consider filtering DNS requests to unknown, untrusted, or known bad domains and resources. Resolving DNS requests with on-premise/proxy servers may also disrupt adversary attempts to conceal data within DNS packets.
Threat Groups (11)
| ID | Group | Context |
|---|---|---|
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) used DNS for C2 communications.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021) |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) has performed C2 using DNS via A, OPT, and TXT records.(Citation: FireEye FIN7 Aug 2018) |
| G0026 | APT18 | [APT18](https://attack.mitre.org/groups/G0026) uses DNS for C2 communications.(Citation: PaloAlto DNS Requests May 2016) |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used remote access tools that leverage DNS in communications with C2.(Citation: BitDefender Chafer ... |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has used DNS for C2 including the publicly available <code>requestbin.net</code> tunneling service.(Ci... |
| G0081 | Tropic Trooper | [Tropic Trooper](https://attack.mitre.org/groups/G0081)'s backdoor has communicated to the C2 over the DNS protocol.(Citation: TrendMicro Tropic Troop... |
| G0004 | Ke3chang | [Ke3chang](https://attack.mitre.org/groups/G0004) malware RoyalDNS has used DNS for C2.(Citation: NCC Group APT15 Alive and Strong) |
| G0114 | Chimera | [Chimera](https://attack.mitre.org/groups/G0114) has used [Cobalt Strike](https://attack.mitre.org/software/S0154) to encapsulate C2 in DNS traffic.(C... |
| G1003 | Ember Bear | [Ember Bear](https://attack.mitre.org/groups/G1003) has used DNS tunnelling tools, such as dnscat/2 and Iodine, for C2 purposes.(Citation: CISA GRU291... |
| G0140 | LazyScripter | [LazyScripter](https://attack.mitre.org/groups/G0140) has leveraged dynamic DNS providers for C2 communications.(Citation: MalwareBytes LazyScripter F... |
| G0080 | Cobalt Group | [Cobalt Group](https://attack.mitre.org/groups/G0080) has used DNS tunneling for C2.(Citation: Talos Cobalt Group July 2018)(Citation: PTSecurity Coba... |
Associated Software (43)
| ID | Name | Type | Context |
|---|---|---|---|
| S9015 | BRICKSTORM | Malware | [BRICKSTORM](https://attack.mitre.org/software/S9015) has used DNS over HTTPS to resolve C2 infrastructure and obscure DNS traffic from inspection.(Ci... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) can use DNS for C2 communications.(Citation: FireEye APT34 Dec 2017)(Citation: FireEye APT34 Webin... |
| S0145 | POWERSOURCE | Malware | [POWERSOURCE](https://attack.mitre.org/software/S0145) uses DNS TXT records for C2.(Citation: FireEye FIN7 March 2017)(Citation: Cisco DNSMessenger Ma... |
| S0167 | Matryoshka | Malware | [Matryoshka](https://attack.mitre.org/software/S0167) uses DNS for C2.(Citation: ClearSky Wilted Tulip July 2017)(Citation: CopyKittens Nov 2015) |
| S9001 | SystemBC | Malware | [SystemBC](https://attack.mitre.org/software/S9001) has used DNS servers to resolve .bit domains to C2 infrastructure.(Citation: HarmonProofpoint_Syst... |
| S0514 | WellMess | Malware | [WellMess](https://attack.mitre.org/software/S0514) has the ability to use DNS tunneling for C2 communications.(Citation: PWC WellMess July 2020)(Cita... |
| S0615 | SombRAT | Malware | [SombRAT](https://attack.mitre.org/software/S0615) can communicate over DNS with the C2 server.(Citation: BlackBerry CostaRicto November 2020)(Citatio... |
| S0260 | InvisiMole | Malware | [InvisiMole](https://attack.mitre.org/software/S0260) has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and... |
| S0495 | RDAT | Malware | [RDAT](https://attack.mitre.org/software/S0495) has used DNS to communicate with the C2.(Citation: Unit42 RDAT July 2020) |
| S0146 | TEXTMATE | Malware | [TEXTMATE](https://attack.mitre.org/software/S0146) uses DNS TXT records for C2.(Citation: FireEye FIN7 March 2017) |
| S0690 | Green Lambert | Malware | [Green Lambert](https://attack.mitre.org/software/S0690) can use DNS for C2 communications.(Citation: Objective See Green Lambert for OSX Oct 2021)(Ci... |
| S0504 | Anchor | Malware | Variants of [Anchor](https://attack.mitre.org/software/S0504) can use DNS tunneling to communicate with C2.(Citation: Cyberreason Anchor December 2019... |
| S0013 | PlugX | Malware | [PlugX](https://attack.mitre.org/software/S0013) can be configured to use DNS for command and control.(Citation: Dell TG-3390) |
| S0125 | Remsec | Malware | [Remsec](https://attack.mitre.org/software/S0125) is capable of using DNS for C2.(Citation: Symantec Remsec IOCs)(Citation: Kaspersky ProjectSauron Fu... |
| S1111 | DarkGate | Malware | [DarkGate](https://attack.mitre.org/software/S1111) can cloak command and control traffic in DNS records from legitimate services to avoid reputation-... |
| S0228 | NanHaiShu | Malware | [NanHaiShu](https://attack.mitre.org/software/S0228) uses DNS for the C2 communications.(Citation: fsecure NanHaiShu July 2016) |
| S1047 | Mori | Malware | [Mori](https://attack.mitre.org/software/S1047) can use DNS tunneling to communicate with C2.(Citation: DHS CISA AA22-055A MuddyWater February 2022)(C... |
| S0269 | QUADAGENT | Malware | [QUADAGENT](https://attack.mitre.org/software/S0269) uses DNS for C2 communications.(Citation: Unit 42 QUADAGENT July 2018) |
| S0022 | Uroburos | Malware | [Uroburos](https://attack.mitre.org/software/S0022) has encoded outbound C2 communications in DNS requests consisting of character strings made to res... |
| S1021 | DnsSystem | Malware | [DnsSystem](https://attack.mitre.org/software/S1021) can direct queries to custom DNS servers and return C2 commands using TXT records.(Citation: Zsc... |
Related CWE Weaknesses
References
- Galobardes, R. (2018, October 30). Learn how easy is to bypass firewalls using DNS tunneling (and also how to block it). Retrieved March 15, 2020.
- Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
- Kyle Wilhoit, Robert Falcone. (2018, September 12). OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government. Retrieved July 21, 2025.
- Palo Alto Networks. (n.d.). What Is DNS Tunneling?. Retrieved March 15, 2020.
- Vercara. (n.d.). Retrieved July 21, 2025.
Frequently Asked Questions
What is T1071.004 (DNS)?
T1071.004 is a MITRE ATT&CK technique named 'DNS'. It belongs to the Command and Control tactic(s). Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and...
How can T1071.004 be detected?
Detection of T1071.004 (DNS) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1071.004?
There are 2 documented mitigations for T1071.004. Key mitigations include: Network Intrusion Prevention, Filter Network Traffic.
Which threat groups use T1071.004?
Known threat groups using T1071.004 include: APT41, FIN7, APT18, APT39, OilRig, Tropic Trooper, Ke3chang, Chimera.