Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1071.004: DNS

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.[1][2]

DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. Protocol Tunneling). The commands may be embedded into different DNS records, for example, TXT or A records.[3] DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.[4] Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.

EnterpriseT1071.004Sub-techniqueObject v1.4 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

DNS command-and-control matters because DNS is normally required for business operations and is often allowed through network controls, which makes malicious communications easier to hide among routine traffic. The practical risk is not just “DNS tunneling”; it is whether the organization can distinguish necessary name resolution from covert command traffic across Windows, Linux, macOS, ESXi, and network-device environments.

Executive priority

Treat this as a resilience and visibility question: can the organization prove that DNS egress is governed, monitored, and investigated rather than simply allowed by default? Because ATT&CK links this technique to multiple groups, malware families, and a campaign, leaders should prioritize DNS logging, boundary filtering, and intrusion prevention as control evidence for incident response readiness, audit discussions, and network-risk reduction. The key decision is whether DNS is managed as a controlled service or as an unmanaged bypass path.

Technical view

This is an enterprise command-and-control sub-technique under Application Layer Protocol. ATT&CK notes that adversaries may embed commands and results in DNS traffic, including DNS tunneling and DNS beaconing using records such as TXT or A records. SOC and IR teams should validate whether they can analyze DNS queries, responses, record types, query frequency, destination domains, resolver paths, and traffic crossing network boundaries. There is no official MITRE detection text supplied, but the relationship to DET0400 indicates behavioral detection of DNS tunneling and application-layer abuse is relevant. Relationships to tools such as PlugX, Uroburos, Pisloader, POWERSOURCE, TEXTMATE, and Cobalt Strike support using malware and intrusion reporting as context for detection engineering, without assuming local exposure.

Likely telemetry

  • Recursive DNS resolver logs
  • Endpoint DNS query events where available
  • Network DNS packet metadata and full packet capture where retained
  • Firewall, proxy, and egress filtering logs for DNS traffic
  • Network intrusion detection or prevention alerts

Detection direction

  • Confirm whether DNS telemetry covers all listed platforms and network segments, including servers, endpoints, ESXi-adjacent infrastructure, and network devices where applicable.
  • Develop behavioral analytics for unusual DNS tunneling indicators such as high-volume or structured subdomain usage, uncommon record-type patterns, suspicious TXT/A record usage, and low-frequency beaconing that may blend with normal traffic.
  • Tune detections against known business DNS behaviors to reduce false positives from legitimate cloud, software update, security, and content-delivery services.
  • Validate that DNS requests are expected to flow through approved resolvers; direct external DNS from endpoints or servers should be investigated according to local policy.
  • Use relationship context from associated campaigns, groups, and software to enrich threat hunting, but do not treat those relationships as proof of activity in the environment.

Mitigation priorities

  • Prioritize network intrusion prevention at boundaries, consistent with M1031, using signatures or detections for known DNS tunneling and application-layer abuse where appropriate.
  • Implement network traffic filtering consistent with M1037: restrict DNS egress to approved resolvers and enforce firewall rules for ingress, egress, and lateral DNS traffic.
  • Review whether DNS is permitted before network authentication and determine whether that exposure is necessary for the business environment.
  • Centralize DNS resolution and logging so incident responders can reconstruct suspected command-and-control activity.
  • Pair filtering with monitoring; blocking alone may miss infrequent DNS beaconing or traffic designed to resemble normal DNS behavior.
Analyst notes and limits

The strongest business takeaway is that DNS is a high-trust administrative protocol that can become a covert communications channel if it is not governed. The supplied relationships show broad technique relevance across multiple named groups, software families, and one campaign, but they do not establish current activity against any specific organization. Glexia would use this object to drive DNS visibility assessment, egress-control validation, SOC tuning, and IR evidence readiness.

The official ATT&CK object does not provide detection text. External references are listed, but this take uses only the supplied descriptions and relationships. Specific indicators, thresholds, vendor detections, and environment exposure require local DNS baselines, architecture review, and telemetry validation.

Official MITRE ATT&CK definition

DNS

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.[1][2]

DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. Protocol Tunneling). The commands may be embedded into different DNS records, for example, TXT or A records.[3] DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.[4] Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1071 Application Layer Protocol This object subtechnique of Application Layer Protocol.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0114: Chimera

Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.[1][2]

Group Enterprise

G0096: APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]

Group Enterprise

G0080: Cobalt Group

Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM systems, card processing, payment systems and SWIFT systems. Cobalt Group has mainly targeted banks in Eastern Europe, Central Asia, and Southeast Asia. One of the alleged leaders was arrested in Spain in early 2018, but the group still appears to be active. The group has been known to target organizations in order to use their access to then compromise additional victims.[1][2][3][4][5][6][7] Reporting indicates there may be links between Cobalt Group and both the malware Carbanak and the group Carbanak.[8]

Group Enterprise

G0049: OilRig

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.[1][2][3][4][5][6][7]

Group Enterprise

G0004: Ke3chang

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.[1][2][3][4]

Group Enterprise

G0087: APT39

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.[1][2][3][4][5]

Group Enterprise

G1003: Ember Bear

Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).[1] Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.[2] Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022.[3][4][1] There is some confusion as to whether Ember Bear overlaps with another Russian-linked entity referred to as Saint Bear. At present available evidence strongly suggests these are distinct activities with different behavioral profiles.[2][5]

Group Enterprise

G0026: APT18

APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. [1]

Group Enterprise

G0046: FIN7

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.[1][2][3][4][5][6][7]

Malware Enterprise

S0477: Goopy

Goopy is a Windows backdoor and Trojan used by APT32 and shares several similarities to another backdoor used by the group (Denis). Goopy is named for its impersonation of the legitimate Google Updater executable.[1]

Windows
Malware Enterprise

S1111: DarkGate

DarkGate first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named "DarkGate" by its author, DarkGate is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions.[1] DarkGate use increased significantly starting in 2022 and is under active development by its author, who provides it as a Malware-as-a-Service offering.[2]

Windows
Malware Enterprise

S1020: Kevin

Kevin is a backdoor implant written in C++ that has been used by HEXANE since at least June 2020, including in operations against organizations in Tunisia.[1]

Windows
Malware Enterprise

S0377: Ebury

Ebury is an OpenSSH backdoor and credential stealer targeting Linux servers and container hosts developed by Windigo. Ebury is primarily installed through modifying shared libraries (`.so` files) executed by the legitimate OpenSSH program. First seen in 2009, Ebury has been used to maintain a botnet of servers, deploy additional malware, and steal cryptocurrency wallets, credentials, and credit card details.[1][2][3][4]

Linux
Malware Enterprise

S0170: Helminth

Helminth is a backdoor that has at least two variants - one written in VBScript and PowerShell that is delivered via a macros in Excel spreadsheets, and one that is a standalone Windows executable. [1]

Windows
Tool Enterprise

S0699: Mythic

Mythic is an open source, cross-platform post-exploitation/command and control platform. Mythic is designed to "plug-n-play" with various agents and communication channels.[1][2][3] Deployed Mythic C2 servers have been observed as part of potentially malicious infrastructure.[4]

WindowsLinuxmacOS
Malware Enterprise

S0495: RDAT

RDAT is a backdoor used by the suspected Iranian threat group OilRig. RDAT was originally identified in 2017 and targeted companies in the telecommunications sector.[1]

Windows
Campaign Enterprise

C0029: Cutting Edge

Cutting Edge was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of zero-day vulnerabilities in Ivanti Connect Secure (previously Pulse Secure) VPN appliances. Cutting Edge targeted the U.S. defense industrial base and multiple sectors globally including telecommunications, financial, aerospace, and technology. Cutting Edge featured the use of defense evasion and living-off-the-land (LoTL) techniques along with the deployment of web shells and other custom malware.[1][2][3][4][5]

Relationship explorer

All related ATT&CK context

uses · Malware S0477: Goopy Enterprise uses · Malware S0269: QUADAGENT Enterprise uses · Malware S0354: Denis Enterprise uses · Malware S0663: SysUpdate Enterprise uses · Malware S1111: DarkGate Enterprise uses · Malware S0146: TEXTMATE Enterprise uses · Malware S1020: Kevin Enterprise uses · Malware S1015: Milan Enterprise uses · Malware S0377: Ebury Enterprise uses · Malware S0170: Helminth Enterprise uses · Tool S0699: Mythic Enterprise uses · Malware S0495: RDAT Enterprise mitigates · Mitigation M1037: Filter Network Traffic Enterprise uses · Group G0114: Chimera Enterprise uses · Malware S0184: POWRUNER Enterprise subtechnique of · Technique T1071: Application Layer Protocol Enterprise uses · Campaign C0029: Cutting Edge Enterprise uses · Malware S0514: WellMess Enterprise uses · Malware S1090: NightClub Enterprise uses · Malware S0124: Pisloader Enterprise uses · Malware S1014: DanBot Enterprise uses · Malware S9001: SystemBC Enterprise uses · Malware S1027: Heyoka Backdoor Enterprise uses · Malware S1021: DnsSystem Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1037: Filter Network Traffic

Employ network appliances and endpoint software to filter ingress, egress, and lateral network traffic. This includes protocol-based filtering, enforcing firewall rules, and blocking or restricting traffic based on predefined conditions to limit adversary movement and data exfiltration. This mitigation can be implemented through the following measures:

Ingress Traffic Filtering:

- Use Case: Configure network firewalls to allow traffic only from authorized IP addresses to public-facing servers. - Implementation: Limit SSH (port 22) and RDP (port 3389) traffic to specific IP ranges.

Egress Traffic Filtering:

- Use Case: Use firewalls or endpoint security software to block unauthorized outbound traffic to prevent data exfiltration and command-and-control (C2) communications. - Implementation: Block outbound traffic to known malicious IPs or regions where communication is unexpected.

Protocol-Based Filtering:

- Use Case: Restrict the use of specific protocols that are commonly abused by adversaries, such as SMB, RPC, or Telnet, based on business needs. - Implementation: Disable SMBv1 on endpoints to prevent exploits like EternalBlue.

Network Segmentation:

- Use Case: Create network segments for critical systems and restrict communication between segments unless explicitly authorized. - Implementation: Implement VLANs to isolate IoT devices or guest networks from core business systems.

Application Layer Filtering:

- Use Case: Use proxy servers or Web Application Firewalls (WAFs) to inspect and block malicious HTTP/S traffic. - Implementation: Configure a WAF to block SQL injection attempts or other web application exploitation techniques.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.4
Created
Modified
Raw hash
1f634e3439a68ac8...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.4 Current bundle 1f634e3439a6…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    PAN DNS Tunneling

    Palo Alto Networks. (n.d.). What Is DNS Tunneling?. Retrieved March 15, 2020.

    Open source URL
  2. [2]
    Medium DnsTunneling

    Galobardes, R. (2018, October 30). Learn how easy is to bypass firewalls using DNS tunneling (and also how to block it). Retrieved March 15, 2020.

    Open source URL
  3. [3]
    OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government

    Kyle Wilhoit, Robert Falcone. (2018, September 12). OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government. Retrieved July 21, 2025.

    Open source URL
  4. [4]
    DNS Beacons

    Vercara. (n.d.). Retrieved July 21, 2025.

    Open source URL
  5. [5]
    University of Birmingham C2

    Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.

    Open source URL
  6. [6]
    mitre-attack T1071.004
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use