Skip to content
Threat Feed
Subscribe

Tag

Dns-Tunneling

5 briefs RSS
medium advisory

Suspicious PowerShell DNS Payload Extraction via Nslookup

Adversaries leverage nslookup within PowerShell execution flows to retrieve malicious payloads encoded in DNS TXT records, bypassing traditional network egress filtering.

command-and-control powershell dns-tunneling
1r 1t
high threat

TrickBot Variant Utilizes DNS Tunneling for Command and Control

FortiGuard Labs analyzed a new TrickBot variant that employs DNS tunneling for command and control communications, modular execution, and incorporates persistence and obfuscation techniques to evade detection and maintain presence on infected systems.

TrickBot malware banking-trojan dns-tunneling c2 persistence obfuscation
4t
medium advisory

Potential DNS Exfiltration via Excessive Chunked Queries

This brief details the technique of DNS exfiltration where threat actors use chunked DNS queries with subdomain labels following an 'index-payload.base_domain' pattern to exfiltrate data from compromised Windows hosts, allowing them to bypass volume-based detection and extract sensitive information.

exfiltration dns-tunneling data-exfiltration windows endpoint command-and-control
1r 2t
medium advisory

Potential DNS Tunneling via NsLookup

Detection of multiple nslookup.exe executions with explicit query types from a single host, potentially indicating command and control activity via DNS tunneling, where attackers abuse DNS for data infiltration or exfiltration.

M365 Defender +2 dns-tunneling command-and-control windows
2r 2t
medium advisory

Potential DNS Tunneling via NsLookup

Multiple executions of nslookup.exe with explicit query types from a single host may indicate command and control activity using DNS tunneling.

dns-tunneling command-and-control windows
2r 2t