DNS
Subtechnique · ATTACK:enterprise:T1071.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1071.004",
"title": "DNS",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1071/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--1996eef1-ced3-4d7f-bf94-33298cabbf72",
"external_id": "T1071.004",
"domain": "enterprise",
"created": "2020-03-15T16:27:31.768Z",
"modified": "2026-09-03T19:46:40.083Z",
"version": "1.4",
"aliases": [
],
"tactics": [
"command-and-control"
],
"source_references": [
{
"source_name": "Medium DnsTunneling",
"url": "https://medium.com/@galolbardes/learn-how-easy-is-to-bypass-firewalls-using-dns-tunneling-and-also-how-to-block-it-3ed652f4a000"
},
{
"source_name": "University of Birmingham C2",
"url": "https://arxiv.org/pdf/1408.1136"
},
{
"source_name": "OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government",
"url": "https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/"
},
{
"source_name": "PAN DNS Tunneling",
"url": "https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunneling"
},
{
"source_name": "DNS Beacons",
"url": "https://vercara.digicert.com/resources/dns-beacons#page_top"
}
]
}Explicit source assertions (59)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0477 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00aa618f-bcfa-4649-8436-134f9d01e43c
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01292102-1f89-4358-b62c-bc0afd49fc52
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01eb6d18-bb7b-4e4a-b133-60407f40773b
Cybereason Oceanlotus May 2017 · Securelist Denis April 2017 · Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04ff77bc-6232-4950-8e9c-6f4dcc83ca9d
Lunghi Iron Tiger LinuxATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b13006f-3662-4175-86b1-607f20895863
Ensilo Darkgate 2018ATTACK:enterprise:S0146 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d9114a6-6452-4668-95eb-f91bcb300d2d
FireEye FIN7 March 2017ATTACK:enterprise:S1020 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11c19a8d-fd24-4c59-9a5f-4910f5471e71
Kaspersky Lyceum October 2021ATTACK:enterprise:S1015 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a2a6b85-7e72-409a-80bd-13a3f726de5a
Accenture Lyceum Targets November 2021 · ClearSky Siamesekitten August 2021 · Kaspersky Lyceum October 2021ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b27a43c-3508-4f21-9f39-c05b2be84cb6
ESET Ebury Feb 2014ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39689be2-bc35-4d89-9233-08bda52a4229
Palo Alto OilRig May 2016ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a8ce0e1-0c2e-4ce5-bd21-8d51b3027376
Mythc DocumentationATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d70f1d9-366a-4510-91f6-fe15ca06d7a8
Unit42 RDAT July 2020ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d719505-cb0d-4dc4-8f23-fee0577a6359
LevelBlue_Vidar_May2026ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--444dc2e9-3f54-4ab9-b004-363ae1221373
ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46d350be-fcde-4c7a-ac75-d86c8f5ccd5f
NCC Group Chimera January 2021ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49363ea2-b33e-4cc4-a283-ab7d30530c27
FireEye APT34 Dec 2017 · FireEye APT34 Webinar Dec 2017ATTACK:enterprise:T1071.004 → subtechnique-of → ATTACK:enterprise:T1071
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ebeacbf-4f30-4f32-86dc-54d932ea7c46
ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f27c041-e965-4ee3-b47c-6681e7fc1ace
Mandiant Cutting Edge Part 2 January 2024ATTACK:enterprise:S0514 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f7ce20c-fab3-4dbd-be9f-c023d7b0bd90
PWC WellMess July 2020 · NCSC APT29 July 2020ATTACK:enterprise:S1090 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50c1c2f4-be50-49dc-bac6-dce8e80436ae
MoustachedBouncer ESET August 2023ATTACK:enterprise:S0124 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59d4e54d-66b8-4603-b189-ba67160da44d
Palo Alto DNS RequestsATTACK:enterprise:S1014 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c45d533-4299-47a0-9a3b-7085c219ba6a
SecureWorks August 2019ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5fac7323-462e-4ef5-848b-5ff54833a67e
HarmonProofpoint_SystemBC_Aug2019ATTACK:enterprise:S1027 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66bac3e2-3a04-4ad0-8f38-fa952e7289c6
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:S1021 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68ddf3bf-bf01-4de5-8b0e-e00db5a8ee7e
Zscaler Lyceum DnsSystem June 2022ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a4ee5a3-9bc2-4352-856a-ae078ddc6cf2
Talos Cobalt Strike September 2020 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70c0fd33-8091-4e58-896b-0be55429ee91
ESET Gelsemium June 2021ATTACK:enterprise:S0360 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--730a2fb5-2f51-4db1-b4f1-2112d64df4bf
Palo Alto OilRig Sep 2018ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73ddd025-b313-49cc-8a28-4c3869eb5a16
GitHub Sliver C2 DNS · Cybereason Sliver Undated · Bishop Fox Sliver Framework August 2019 · Microsoft Sliver 2022 · Cybersecurity Advisory SVR TTP May 2021ATTACK:enterprise:S0690 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ce75658-c5ea-484d-ab1d-2dca045a244b
Objective See Green Lambert for OSX Oct 2021 · Glitch-Cat Green Lambert ATTCK Oct 2021ATTACK:enterprise:S0070 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7eb3d9b7-8058-4d26-9196-b9a79716c5f9
Dell TG-3390 · ThreatStream Evasion AnalysisATTACK:enterprise:S1047 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7fb6c376-1d2b-4dfa-98cc-623b7567f3cf
CYBERCOM Iranian Intel Cyber January 2022 · DHS CISA AA22-055A MuddyWater February 2022ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86e0245b-787c-4cf8-9399-531d64529d4d
MalwareBytes LazyScripter Feb 2021ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--873faf92-be75-47e5-bf3e-b389a5bdc020
FireEye APT41 Aug 2019 · Group IB APT 41 June 2021ATTACK:enterprise:S0504 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8bb2744c-3ea2-418b-818d-aaabe0c7746f
Cyberreason Anchor December 2019 · Medium Anchor DNS July 2020ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8de247e5-8d6b-4a07-bd65-ba3c3ca57923
Talos Cobalt Group July 2018 · PTSecurity Cobalt Dec 2016 · Group IB Cobalt Aug 2017ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8dfb6f79-5a9a-4eb8-9b25-40d82ff0f668
FireEye APT34 July 2019 · Check Point APT34 April 2021 · FireEye APT34 Webinar Dec 2017 · Unit42 OilRig Playbook 2023ATTACK:enterprise:S0596 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--936ff38b-73f6-48fe-876f-8ebd3b60df1f
Kaspersky ShadowPad Aug 2017ATTACK:enterprise:S0338 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94c08652-89f8-406d-b0c0-aeb35da36d99
Zscaler Cobian Aug 2017ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96a7d789-70a9-42d8-a78e-b7ffd6c9dc69
NCC Group APT15 Alive and StrongATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a66e38c-ea79-4b7b-bf74-555da87d58c3
BitDefender Chafer May 2020ATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9bca83aa-4200-45a4-a978-1ccc75561d5e
BlackBerry CostaRicto November 2020 · FireEye FiveHands April 2021ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c6804dc-e1d5-43f5-97ee-7d827c9d308d
ESET InvisiMole June 2020ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a01fe77e-2091-4938-b639-21d21704c7a2
CISA GRU29155 2024ATTACK:enterprise:S0157 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a403648d-4c23-46bd-9688-1face1407b42
FireEye APT32 May 2017ATTACK:enterprise:S0228 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aae339ae-44bb-48d3-b62e-7f35376bb974
fsecure NanHaiShu July 2016ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af9e92df-d4d0-437a-9114-823b6a2a14a6
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b4947254-3a74-4708-a45c-65eff5bd9a2c
Dell TG-3390ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6a60179-abb0-41ec-96cc-112abe232509
FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:G0026 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1cf88bc-6229-4d62-86f5-36aa0e7bd21a
PaloAlto DNS Requests May 2016ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4014fde-9d6e-4605-a143-36556a280249
Palo Alto Brute Ratel July 2022 · Trend Micro Black Basta October 2022ATTACK:enterprise:S0167 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c476a0da-44fd-4492-86ae-407aabab3735
ClearSky Wilted Tulip July 2017 · CopyKittens Nov 2015ATTACK:enterprise:S0145 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c560f682-0d21-4c9b-b35d-33aec2287117
Cisco DNSMessenger March 2017 · FireEye FIN7 March 2017ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9f53392-065d-4573-a08a-37bc3d24d3e5
ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca2a22df-7f99-497a-8f51-cf0180308305
FireEye FIN7 Aug 2018ATTACK:enterprise:S1019 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9113d90-4c55-465a-88c6-b58c40b46f96
Accenture Lyceum Targets November 2021 · ClearSky Siamesekitten August 2021ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec439835-0ccb-477e-8c58-1d8c4e8ed6ab
Symantec Remsec IOCs · Kaspersky ProjectSauron Full Report · Kaspersky ProjectSauron Technical AnalysisATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eecaf2ba-9971-4657-9a55-5df1bfba6a1b
CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025 · CISA BRICKSTORM UNC5221 AR25-338A February 2026 · Picus Security BRICKSTORM UNC5221 October 2025 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024 · NVISO BRICKSTORM April 2025ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2ae5e48-aded-40ba-8991-68b79638d6b0
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023