attack.t1071.004 | Detection.FYI

Silence.EDA Detection
Apr 11, 2023 · attack.execution attack.t1059.001 attack.command_and_control attack.t1071.004 attack.t1572 attack.impact attack.t1529 attack.g0091 attack.s0363 ·
Share on:
Detects Silence EmpireDNSAgent as described in the Group-IP report

Read More
OilRig APT Registry Persistence
Mar 9, 2023 · attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense_evasion attack.t1112 attack.command_and_control attack.t1071.004 ·
Share on:
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

Read More
DNS Exfiltration and Tunneling Tools Execution
Feb 21, 2023 · attack.exfiltration attack.t1048.001 attack.command_and_control attack.t1071.004 attack.t1132.001 ·
Share on:
Well-known DNS Exfiltration tools execution

Read More
Cobalt Strike DNS Beaconing
Feb 1, 2023 · attack.command_and_control attack.t1071.004 ·
Share on:
Detects suspicious DNS queries known from Cobalt Strike beacons

Read More
Suspicious Cobalt Strike DNS Beaconing - DNS Client
Feb 1, 2023 · attack.command_and_control attack.t1071.004 ·
Share on:
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Read More
Suspicious Cobalt Strike DNS Beaconing - Sysmon
Feb 1, 2023 · attack.command_and_control attack.t1071.004 ·
Share on:
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Read More
Suspicious DNS Query with B64 Encoded String
Feb 1, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:
Detects suspicious DNS queries using base64 encoding

Read More
DNS TXT Answer with Possible Execution Strings
Oct 25, 2022 · attack.command_and_control attack.t1071.004 ·
Share on:
Detects strings used in command execution in DNS TXT Answer

Read More