domains / families / security / detecting-command-and-control-over-dns

detecting-command-and-control-over-dns

separate

'Detect command-and-control (C2) traffic tunneled over DNS from tools like

When to use

• Investigating suspected DNS tunneling used for C2 communication or data exfiltration
• Analyzing DNS query logs for signs of encoded payloads in subdomain strings
• Classifying domains as DGA-generated vs. legitimate using statistical or ML methods
• Detecting DNS beaconing patterns (regular intervals, consistent query sizes)
• Hunting for Iodine, dnscat2, dns2tcp, Cobalt Strike DNS, or Sliver DNS traffic
• Monitoring TXT record abuse for command delivery or staged payload download
• Building DNS anomaly detection rules for SOC/SIEM deployment

When not to use

• General DNS performance monitoring
• DNS configuration auditing
• HTTP/HTTPS-based C2 detection

Skill page

Source