Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Command and Control/ T1071.004

T1071.004DNS

T1071.004 — DNS is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 33 detection use cases covering it and 166 threat-intel articles citing it.

Command and Control
View on the matrix → Filter Detection Library MITRE official spec ↗
33Use cases
166Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1071 · Application Layer Protocol

Use cases covering this technique (33)

Beaconing — periodic outbound to small set of destinations Internal c2 · alerting DSP DNS tunneling / TXT-heavy domain queries Internal c2 · hunting DSP Windows AI Platform DNS Query ESCU actions · hunting P Windows Credential Target Information Structure in Commandline ESCU actions · alerting P Windows Kerberos Coercion via DNS ESCU actions · alerting P Windows Short Lived DNS Record ESCU actions · alerting P Windows Visual Basic Commandline Compiler DNSQuery ESCU actions · alerting P DNS Kerberos Coercion ESCU actions · alerting P Excessive DNS Failures ESCU actions · hunting P Windows DNS Query Request by Telegram Bot API ESCU actions · hunting P DNS Query Length Outliers - MLTK ESCU actions · hunting P DNS Query Requests Resolved by Unauthorized DNS Servers ESCU actions · alerting P DNS record changed ESCU actions · alerting P [LLM] OWAReaper C2 / exfiltration egress to TA488 CDN and DNS-tunnel domains Bespoke c2 · alerting DSΣPDDCS [LLM] BINDCLOAK C2 beacon to cert.hypersnet.com / ssl.blsouqs.com Bespoke c2 · alerting DSΣPDDCS [LLM] CAV3RN/HOLLOWGRAPH DNS AAAA config-recovery beaconing to cloudlanecdn[.]com Bespoke c2 · alerting DSΣPCS [LLM] TuxBot fallback C2 via digikalas.online DGA subdomains and DNS TXT queries Bespoke c2 · hunting DSΣPCS [LLM] Apache Camel DNS SSRF: inbound HTTP request carrying dns.server / dns.name control headers Bespoke delivery · hunting SΣP [LLM] Apache Camel DNS SSRF egress: app server (java) resolving via external / attacker DNS resolver Bespoke actions · hunting DSΣPDDCS [LLM] DNS resolution of TeamPCP typosquat exfil domain scan.aquasecurtiy.org Bespoke c2 · alerting DSΣPCS [LLM] OceanLotus SPECTRALVIPER C2 communication to FireAnt-campaign domains/IPs Bespoke c2 · hunting DSΣPDDCS [LLM] Nx Console / Shai-Hulud C2 connection (t.m-kosche.com, check.git-service.com, filev2.getsession.org, api.masscan.cloud, 83.142.209.194) Bespoke c2 · alerting DSΣPDDCS [LLM] DNS / Network egress to TeamPCP Nx Console C2 domain check.git-service.com Bespoke c2 · alerting DSΣPDDCS [LLM] DNS lookup for azurestaticprovider[.]net node-ipc exfil domain Bespoke c2 · alerting DSΣPDDCS [LLM] Session/Oxen P2P exfil DNS or TCP to getsession.org from build/CI host Bespoke c2 · alerting DSΣPDD [LLM] IoliteLabs IOC sweep: rraghh.com / oortt.com hostnames + campaign file hashes Bespoke c2 · hunting DSΣPDD [LLM] bittensor-wallet 4.0.2 backdoor C2 domain contact (opentensor-* lookalikes) Bespoke c2 · alerting DSΣPDD [LLM] DNS tunneling exfiltration pattern to *.t.opentensor-cdn.com (hex chunk/index/total/session) Bespoke c2 · alerting DSΣPDD [LLM] DNS/HTTP egress to CanisterWorm ICP canister C2 (tdtqy-oyaaa-aaaae-af2dq-cai) Bespoke c2 · alerting DSΣPDDCS [LLM] GhostChat C2/staging infrastructure contact (hitpak.org, buildthenations.info, fkclb.com) Bespoke c2 · alerting DSΣPDDCS [LLM] Java process fetching first-seen external URL/DNS — Commons Config url/dns lookup (CVE-2022-33980) Bespoke c2 · hunting DSPDDCS [LLM] npm dropper exfiltration to pkgio.com telemetry server Bespoke exfil · alerting DSΣPDDCS [LLM] npm dropper DNS exfil to pkgio.com / game-note.com (gxm-reference campaign) Bespoke c2 · alerting DSΣPCS

Articles citing this technique (166)

crit Toy Ghouls’ new toy: the GenieLocker ransomware art-00
crit Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation art-01
crit FCC Blocks New Foreign-Produced Robots and Power Inverters Over Cyber Risks art-02
crit Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet art-03
high Russian hackers exploit Exchange OWA zero-day for long-term mailbox access art-05
high Four incident-response decisions from the Hugging Face breach art-07
high Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare art-10
crit OpenAI agent used exposed credentials at 4 services in Hugging Face breach art-12
crit OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach art-30
crit Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates art-32
crit Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js art-33
crit 2026 Mid-Year Update: On Pace for Our Biggest Year Yet art-36
high Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process art-46
crit Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays art-52
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-53
crit Mirage Kitten targets Middle East and Africa region with new malware art-56
high NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework art-60
crit Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption art-61
crit Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware art-68
crit TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments art-69
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-80
crit Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry art-105
crit Golden Chickens Resurfaces With Four New Malware Families and Modular Implants art-106
crit Don’t swing at everything art-107
crit Russian Global Webmail Espionage art-112
high Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel art-113
high The upgrade trap: when upgrading is the wrong answer to a CVE art-120
high A new extortion cocktail: office printers, small ransoms, and BitLocker art-131
high New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery art-133
high SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor art-141
high ACR Stealer: Two observed intrusion chains amid increased threat activity art-147
crit AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report art-148
crit Begun, the Patch Wars have art-151
crit HelloNet campaign: new malicious modules launched through the ViPNet update system art-153
high GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration art-154
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-157
high Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery art-158
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-164
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-169
crit OkoBot: new sophisticated malware framework targets cryptocurrency users art-170
high The serpent’s tongue: Luring the Python out of its den art-181
high AsyncAPI npm packages backdoored via GitHub Actions art-182
crit jscrambler npm package publishes malicious preinstall binary art-196
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-197
crit No Manners Here: The Ruthless Rise of The Gentlemen Ransomware art-199
crit Winning 54% of the time art-215
crit One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement art-217
crit Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation art-224
crit UAT-7810 continues building ORB networks using new malware art-230
crit [GHSA / CRITICAL] CVE-2026-48205: Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF) art-245
crit Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign art-251
crit 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions art-254
high Maven Support Comes to GitHub Checks and OSS Package Search art-273
high codfish/semantic-release-action GitHub Action has been compromised art-276
high 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers art-277
crit Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector art-280
crit CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure art-293
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-294
high Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets art-299
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301
crit OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat art-302
crit macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox art-303
high Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat art-314
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-322
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-325
high Multiple JetBrains IDE plugins caught stealing AI keys art-326
crit OceanLotus: From external espionage to domestic targeting art-342
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-350
high Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Ag art-351
high Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp art-362
high Multiple redhat-cloud-services npm Packages compromised art-370
high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets art-371
high Nx Console VS Code Extension Compromised art-373
high What MDM can't protect on developer machines (and what to do about it) art-386
crit Laravel Lang Supply Chain Advisory art-399
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-400
high Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories art-401
crit 5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough art-406
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-412
crit Webworm: New burrowing techniques art-413
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-423
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-425
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-427
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-428
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-431
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-435
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-437
crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-442
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-446
crit Fake call logs, real payments: How CallPhantom tricks Android users art-447
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-455
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-456
high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection art-457
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-458
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-475
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-483
crit GopherWhisper: A burrow full of malware art-484
med Hardcoding Security into Every Commit: The Future of Snyk Secrets art-486
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-489
crit New NGate variant hides in a trojanized NFC payment app art-491
high @velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence art-521
high Behind the Scenes: How StepSecurity Detected and Helped Remediate the Largest npm Supply Chain Attack art-522
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-523
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-525
high GlassWorm goes native: New Zig dropper infects every IDE on your machine art-527
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-534
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-535
high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-542
crit litellm: Credential Stealer Hidden in PyPI Wheel art-545
crit Popular telnyx package compromised on PyPI by TeamPCP art-547
high CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem art-551
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-552
crit bittensor-wallet 4.0.2 Compromised on PyPI - Backdoor Exfiltrates Private Keys art-553
high Malicious npm Releases Found in Popular React Native Packages - 130K+ Monthly Downloads Compromised art-554
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-555
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-556
high xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning art-557
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-565
high CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran art-566
high TeamPCP deploys CanisterWorm on NPM following Trivy compromise art-567
crit GlassWorm Hides a RAT Inside a Malicious Chrome Extension art-580
crit fast-draft Open VSX Extension Compromised by BlokTrooper art-581
high Glassworm Strikes Popular React Native Phone Number Packages art-587
crit Sednit reloaded: Back in the trenches art-596
high The Prescriptive Path to Operationalizing AI Security art-676
crit DynoWiper update: Technical analysis and attribution art-684
med Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan art-687
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-728
crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-773
low Snyk @ RSAC 2025 art-971
crit Do not pass GO - Malicious Package Alert art-1067
crit CISA KEV: CVE-2019-11001 — Reolink Multiple IP Cameras OS Command Injection Vulnerability art-1118
high A stepping stone towards holistic application risk and compliance management of the Digital Operational Resiliency Act (DORA) art-1289
crit CISA KEV: CVE-2024-4978 — Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability art-1324
med Snyk Fetch the Flag CTF 2023 writeup: Protect The Environment art-1474
high Using insecure npm package manager defaults to steal your macOS keyboard shortcuts art-1663
high Ethical Hacking: Top Tools art-1702
med New IaC security workshop from Snyk, HashiCorp, and AWS at KubeCon Europe 2023 and on-demand art-1772
crit CISA KEV: CVE-2022-42948 — Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability art-1794
crit CISA KEV: CVE-2022-39197 — Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability art-1795
med Cloud security updates you need to know from re:Invent 2022 art-1879
crit NPM security: preventing supply chain attacks art-1929
crit Understanding DNS attacks: Identifying and patching vulnerabilities art-1949
crit Exploring CVE-2022-33980: the Apache Commons configuration RCE vulnerability art-2101
med SnykWeek Boston: Perspectives on developer security adoption art-2168
crit Snyk finds 200+ malicious npm packages, including Cobalt Strike dependency confusion attacks art-2203
crit Targeted npm dependency confusion attack caught red-handed art-2273
crit CISA KEV: CVE-2021-45382 — D-Link Multiple Routers Remote Code Execution Vulnerability art-2340
med Checking Terraform IaC security in CI/CD with Regula and Bitbucket Pipelines [Tutorial] art-2715
med Snyk achieves AWS Security Competency status art-2758
med Securing S3 bucket configuration and access with Snyk & Solvo art-3067
med Checking AWS AMI IDs in Terraform using Regula and Open Policy Agent art-3077
med Four steps for hardening Amazon EKS security art-3119
high Hardening Amazon EKS security with RBAC, secure IMDS, and audit logging art-3126
med Prevent cloud misconfigurations in HashiCorp Terraform with Snyk IaC art-3160
crit Snyk IaC scanning enhancements include Azure and AWS infrastructure as code art-3207
high AWS vulnerability scanning using the Snyk integration art-3214
med Scanning ARM container images with Snyk art-3289
med Building a secure Amazon S3 bucket (AWS) art-3307
med 3 big Amazon S3 vulnerabilities you may be missing art-3361
med Snyk achieves AWS Lambda Ready designation art-3369
med Snyk achieves Amazon Linux 2 ready designation art-3375
high A technical analysis of the Capital One cloud misconfiguration breach art-3495
high HTTPS Adoption *doubled* this year art-3677
med Architecting a Serverless web application in AWS art-3684
high Immutable infrastructure: Networks art-3695