attack.t1071.004 | Detection.FYI

DNS Query by Finger Utility

Nov 27, 2025 · attack.command-and-control attack.t1071.004 attack.execution attack.t1059.003 ·
Share on:

Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for command and control (C2) communication.

Read More
Network Connection Initiated via Finger.EXE

Nov 27, 2025 · attack.command-and-control attack.t1071.004 attack.execution attack.t1059.003 ·
Share on:

Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such network connections can also help identify potential malicious infrastructure used by threat actors

Read More
Suspicious Cobalt Strike DNS Beaconing - Sysmon

Nov 24, 2025 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Read More
Suspicious Cobalt Strike DNS Beaconing - DNS Client

Nov 10, 2025 · attack.t1071.004 attack.command-and-control ·
Share on:

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Read More
OilRig APT Activity

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig activity as reported by Nyotron in their March 2018 report

Read More
OilRig APT Registry Persistence

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - Security

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
OilRig APT Schedule Task Persistence - System

Oct 23, 2025 · attack.privilege-escalation attack.execution attack.persistence attack.g0049 attack.t1053.005 attack.s0111 attack.t1543.003 attack.defense-evasion attack.t1112 attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Read More
DNS Query To Common Malware Hosting and Shortener Services

Jun 12, 2025 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners. These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc. Such DNS activity can indicate potential delivery or command-and-control communication attempts.

Read More
DNS Query To Katz Stealer Domains

May 26, 2025 · attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.

Read More
DNS Query To Katz Stealer Domains - Network

May 26, 2025 · attack.command-and-control attack.t1071.004 detection.emerging-threats ·
Share on:

Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.

Read More
Cobalt Strike DNS Beaconing

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects suspicious DNS queries known from Cobalt Strike beacons

Read More
DNS Exfiltration and Tunneling Tools Execution

Aug 12, 2024 · attack.exfiltration attack.t1048.001 attack.command-and-control attack.t1071.004 attack.t1132.001 ·
Share on:

Well-known DNS Exfiltration tools execution

Read More
DNS TXT Answer with Possible Execution Strings

Aug 12, 2024 · attack.command-and-control attack.t1071.004 ·
Share on:

Detects strings used in command execution in DNS TXT Answer

Read More
Silence.EDA Detection

Aug 12, 2024 · attack.execution attack.t1059.001 attack.command-and-control attack.t1071.004 attack.t1572 attack.impact attack.t1529 attack.g0091 attack.s0363 ·
Share on:

Detects Silence EmpireDNSAgent as described in the Group-IP report

Read More
Suspicious DNS Query with B64 Encoded String

Aug 12, 2024 · attack.exfiltration attack.t1048.003 attack.command-and-control attack.t1071.004 ·
Share on:

Detects suspicious DNS queries using base64 encoding

Read More
DNSCat2 Powershell Implementation Detection Via Process Creation

Apr 21, 2023 · attack.command_and_control attack.t1071 attack.t1071.004 attack.t1001.003 attack.t1041 ·
Share on:

The PowerShell implementation of DNSCat2 calls nslookup to craft queries. Counting nslookup processes spawned by PowerShell will show hundreds or thousands of instances if PS DNSCat2 is active locally.

Read More
High DNS Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

High DNS requests amount from host per short period of time

Read More
High DNS Requests Rate - Firewall

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

High DNS requests amount from host per short period of time

Read More
High NULL Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

Extremely high rate of NULL record type DNS requests from host per short period of time. Possible result of iodine tool execution

Read More
High TXT Records Requests Rate

Apr 21, 2023 · attack.exfiltration attack.t1048.003 attack.command_and_control attack.t1071.004 ·
Share on:

Extremely high rate of TXT record type DNS requests from host per short period of time. Possible result of Do-exfiltration tool execution

Read More
Possible DNS Tunneling

Apr 21, 2023 · attack.command_and_control attack.t1071.004 attack.exfiltration attack.t1048.003 ·
Share on:

Normally, DNS logs contain a limited amount of different dns queries for a single domain. This rule detects a high amount of queries for a single domain, which can be an indicator that DNS is used to transfer data.

Read More
DNS Query From Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·
Share on:

Detects DNS queries from processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Read More
Download by Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·
Share on:

Detects downloads by processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Read More
File Creation by Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·
Share on:

Detects file creations by processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Read More
Network Connection From Process with Double File Extension

Jan 30, 2023 · attack.defense_evasion attack.command_and_control attack.t1218 attack.t1218.009 attack.t1071 attack.t1071.004 ·
Share on:

Detects network connections from processes with double file extensions, a common method of masquerading or obfuscating a file type in malware delivery. Observed in early 2023 AsyncRAT/Quasar malware delivery using malicious OneNote files.

Read More