Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Command and Control/ T1071.004

T1071.004DNS

T1071.004 — DNS is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 33 detection use cases covering it and 169 threat-intel articles citing it.

Command and Control
View on the matrix → Filter Detection Library MITRE official spec ↗
33Use cases
169Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1071 · Application Layer Protocol

Use cases covering this technique (33)

Beaconing — periodic outbound to small set of destinations Internal c2 · alerting DSP DNS tunneling / TXT-heavy domain queries Internal c2 · hunting DSP Windows AI Platform DNS Query ESCU actions · hunting P Windows Credential Target Information Structure in Commandline ESCU actions · alerting P Windows Kerberos Coercion via DNS ESCU actions · alerting P Windows Powershell Commands from DNS TXT ESCU actions · hunting P Windows Short Lived DNS Record ESCU actions · alerting P Windows Visual Basic Commandline Compiler DNSQuery ESCU actions · alerting P DNS Kerberos Coercion ESCU actions · alerting P Excessive DNS Failures ESCU actions · hunting P Windows DNS Query Request by Telegram Bot API ESCU actions · hunting P DNS Query Length Outliers - MLTK ESCU actions · hunting P DNS Query Requests Resolved by Unauthorized DNS Servers ESCU actions · alerting P DNS record changed ESCU actions · alerting P [LLM] Node.js process direct DNS egress to external resolver (vm2 dns.setServers host hijack) Bespoke c2 · hunting DSΣPDDCS [LLM] Jewelbug XG-Web C2 beacon to Google-Fonts-mimicking domains and IPs Bespoke c2 · hunting DSΣPDDCS [LLM] DNS tunneling: high-volume long/high-entropy subdomain queries to a single parent domain Bespoke c2 · hunting DSΣPCS [LLM] Endpoint issuing DNS directly to unauthorised/external resolvers (resolver bypass) Bespoke c2 · hunting DSΣPDDCS [LLM] DNS TXT/NULL record C2 & exfiltration: high-volume rare-record-type queries from one host Bespoke actions · hunting SPCS [LLM] TuxBot fallback C2 via digikalas.online DGA subdomains and DNS TXT queries Bespoke c2 · hunting DSΣPCS [LLM] DNS resolution of TeamPCP typosquat exfil domain scan.aquasecurtiy.org Bespoke c2 · alerting DSΣPCS [LLM] OceanLotus SPECTRALVIPER C2 communication to FireAnt-campaign domains/IPs Bespoke c2 · hunting DSΣPDDCS [LLM] Nx Console / Shai-Hulud C2 connection (t.m-kosche.com, check.git-service.com, filev2.getsession.org, api.masscan.cloud, 83.142.209.194) Bespoke c2 · alerting DSΣPDDCS [LLM] DNS / Network egress to TeamPCP Nx Console C2 domain check.git-service.com Bespoke c2 · alerting DSΣPDDCS [LLM] DNS lookup for azurestaticprovider[.]net node-ipc exfil domain Bespoke c2 · alerting DSΣPDDCS [LLM] Session/Oxen P2P exfil DNS or TCP to getsession.org from build/CI host Bespoke c2 · alerting DSΣPDD [LLM] IoliteLabs IOC sweep: rraghh.com / oortt.com hostnames + campaign file hashes Bespoke c2 · hunting DSΣPDD [LLM] bittensor-wallet 4.0.2 backdoor C2 domain contact (opentensor-* lookalikes) Bespoke c2 · alerting DSΣPDD [LLM] DNS tunneling exfiltration pattern to *.t.opentensor-cdn.com (hex chunk/index/total/session) Bespoke c2 · alerting DSΣPDD [LLM] GhostChat C2/staging infrastructure contact (hitpak.org, buildthenations.info, fkclb.com) Bespoke c2 · alerting DSΣPDDCS [LLM] Java process fetching first-seen external URL/DNS — Commons Config url/dns lookup (CVE-2022-33980) Bespoke c2 · hunting DSPDDCS [LLM] npm dropper exfiltration to pkgio.com telemetry server Bespoke exfil · alerting DSΣPDDCS [LLM] npm dropper DNS exfil to pkgio.com / game-note.com (gxm-reference campaign) Bespoke c2 · alerting DSΣPCS

Articles citing this technique (169)

crit Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic art-10
crit [GHSA / CRITICAL] GHSA-m5w8-4gq2-6f8x: vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes tha art-11
crit Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies art-25
crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware art-28
crit New AmnesiaStealer macOS malware hijacks browser sessions via remote control art-33
high ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 art-34
crit Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List. art-35
crit New Evooo1Bot Linux botnet turns routers into traffic relay nodes art-36
high Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware art-40
high Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth art-43
high Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers art-44
crit CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps art-45
crit APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit art-48
crit China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud art-49
crit ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories art-51
crit New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure art-53
crit AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS art-55
high The Model Is the Malware | What Four Agentic Intrusions Tell Defenders art-57
crit WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud art-58
crit Dissecting the JWR phishing framework art-60
high Armored Likho expands its cyber-espionage toolkit art-62
crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor art-64
high Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing art-79
crit Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference part art-87
high Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection art-91
crit Kimwolf v7: An Evolution of the Kimwolf Botnet art-92
crit The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications art-96
crit IT threat evolution in Q2 2026. Non-mobile statistics art-99
crit ChainDrop: Inside a Self-Propagating npm Worm art-108
high Token Jacking: Cybercriminals Could Be Stealing Your AI Resources art-112
crit From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide art-116
crit ChainDrop supply chain compromise: Anatomy of a self-propagating worm art-120
crit 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET art-124
high Almost Half of Malware Samples Communicate Direct to IP art-132
crit An analysis of incidents at Brazilian educational institutions art-146
crit Pass the Passkey: A Novel Attack Surface in Passwordless Authentication art-147
high Anthropic Incident: An AI Agent Published a Malicious Package to PyPI and 15 Real Systems Ran It art-148
crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft art-151
crit Network Anomaly Detection in KATA art-159
crit The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version art-160
crit Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan art-163
crit You were onto something with “It’s the Climb,” Miley art-165
crit OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia art-169
crit Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks art-170
high Four incident-response decisions from the Hugging Face breach art-175
crit 2026 Mid-Year Update: On Pace for Our Biggest Year Yet art-182
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-193
crit Don’t swing at everything art-213
crit Russian Global Webmail Espionage art-217
high Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel art-218
high The upgrade trap: when upgrading is the wrong answer to a CVE art-225
high SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor art-245
crit AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report art-250
crit Begun, the Patch Wars have art-253
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-256
crit Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories art-259
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-263
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-267
high AsyncAPI npm packages backdoored via GitHub Actions art-276
crit jscrambler npm package publishes malicious preinstall binary art-290
high Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys art-291
crit One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement art-309
crit 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions art-324
high Maven Support Comes to GitHub Checks and OSS Package Search art-328
high codfish/semantic-release-action GitHub Action has been compromised art-331
high 15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers art-332
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-344
high Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets art-349
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-351
crit macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox art-352
high Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat art-362
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-370
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-373
high Multiple JetBrains IDE plugins caught stealing AI keys art-374
crit OceanLotus: From external espionage to domestic targeting art-388
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-396
high Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Ag art-397
high Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp art-408
high Multiple redhat-cloud-services npm Packages compromised art-416
high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets art-417
high Nx Console VS Code Extension Compromised art-419
high What MDM can't protect on developer machines (and what to do about it) art-432
crit Laravel Lang Supply Chain Advisory art-445
high Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer art-446
high Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories art-447
crit 5 Supply Chain Attacks in 48 Hours: Why Securing One Layer Is Not Enough art-452
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-458
crit Webworm: New burrowing techniques art-459
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-469
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-471
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-473
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-474
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-477
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-481
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-483
crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-488
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-492
crit Fake call logs, real payments: How CallPhantom tricks Android users art-493
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-501
high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection art-502
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-503
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-520
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-528
crit GopherWhisper: A burrow full of malware art-529
med Hardcoding Security into Every Commit: The Future of Snyk Secrets art-530
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-534
crit New NGate variant hides in a trojanized NFC payment app art-536
high @velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence art-566
high Behind the Scenes: How StepSecurity Detected and Helped Remediate the Largest npm Supply Chain Attack art-567
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-568
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-570
high GlassWorm goes native: New Zig dropper infects every IDE on your machine art-572
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-577
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-578
high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-585
crit litellm: Credential Stealer Hidden in PyPI Wheel art-587
high CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem art-592
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-593
crit bittensor-wallet 4.0.2 Compromised on PyPI - Backdoor Exfiltrates Private Keys art-594
high Malicious npm Releases Found in Popular React Native Packages - 130K+ Monthly Downloads Compromised art-595
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-596
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-597
high xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning art-598
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-605
crit Sednit reloaded: Back in the trenches art-629
high The Prescriptive Path to Operationalizing AI Security art-709
crit DynoWiper update: Technical analysis and attribution art-717
med Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan art-719
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-758
crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-803
low Snyk @ RSAC 2025 art-994
crit Do not pass GO - Malicious Package Alert art-1090
crit CISA KEV: CVE-2019-11001 — Reolink Multiple IP Cameras OS Command Injection Vulnerability art-1141
high A stepping stone towards holistic application risk and compliance management of the Digital Operational Resiliency Act (DORA) art-1312
crit CISA KEV: CVE-2024-4978 — Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability art-1347
med Snyk Fetch the Flag CTF 2023 writeup: Protect The Environment art-1497
high Using insecure npm package manager defaults to steal your macOS keyboard shortcuts art-1686
high Ethical Hacking: Top Tools art-1725
med New IaC security workshop from Snyk, HashiCorp, and AWS at KubeCon Europe 2023 and on-demand art-1795
crit CISA KEV: CVE-2022-42948 — Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability art-1817
crit CISA KEV: CVE-2022-39197 — Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability art-1818
med Cloud security updates you need to know from re:Invent 2022 art-1902
crit NPM security: preventing supply chain attacks art-1952
crit Understanding DNS attacks: Identifying and patching vulnerabilities art-1972
crit Exploring CVE-2022-33980: the Apache Commons configuration RCE vulnerability art-2124
med SnykWeek Boston: Perspectives on developer security adoption art-2191
crit Snyk finds 200+ malicious npm packages, including Cobalt Strike dependency confusion attacks art-2226
crit Targeted npm dependency confusion attack caught red-handed art-2296
crit CISA KEV: CVE-2021-45382 — D-Link Multiple Routers Remote Code Execution Vulnerability art-2363
med Checking Terraform IaC security in CI/CD with Regula and Bitbucket Pipelines [Tutorial] art-2738
med Snyk achieves AWS Security Competency status art-2781
med Securing S3 bucket configuration and access with Snyk & Solvo art-3090
med Checking AWS AMI IDs in Terraform using Regula and Open Policy Agent art-3100
med Four steps for hardening Amazon EKS security art-3142
high Hardening Amazon EKS security with RBAC, secure IMDS, and audit logging art-3149
med Prevent cloud misconfigurations in HashiCorp Terraform with Snyk IaC art-3183
crit Snyk IaC scanning enhancements include Azure and AWS infrastructure as code art-3230
high AWS vulnerability scanning using the Snyk integration art-3237
med Scanning ARM container images with Snyk art-3312
med Building a secure Amazon S3 bucket (AWS) art-3330
med 3 big Amazon S3 vulnerabilities you may be missing art-3384
med Snyk achieves AWS Lambda Ready designation art-3392
med Snyk achieves Amazon Linux 2 ready designation art-3398
high A technical analysis of the Capital One cloud misconfiguration breach art-3518
high HTTPS Adoption *doubled* this year art-3700
med Architecting a Serverless web application in AWS art-3707
high Immutable infrastructure: Networks art-3718