Technique
№ 036 · class: exfiltration / impact
DNS Tunneling
Technique of exfiltrating data or C2 communication through DNS queries.
Term
description · examples · notesTechnique of exfiltrating data or C2 communication through DNS queries.
Description
Data is encoded in DNS requests (subdomains) and responses (TXT, CNAME).
It bypasses firewalls because DNS traffic rarely undergoes deep inspection.
Transfer speed is low, but detection without specialized tools is difficult.
Tools like iodine and dnscat2 automate DNS tunneling.
Examples
- dnscat2 for C2 channel over DNS
- OilRig APT using DNS tunneling for exfiltration
Notes
- Can be used for both exfiltration and C2.
Mentioned in the news
Threats
used by 4Threats that use it. Select one to open its page.
Defenses
countered by 7How it is countered. Select one to open its page.