DNS Exfiltration and Tunneling Tools Execution

Title: DNS Exfiltration and Tunneling Tools Execution
Status: test
Description:Well-known DNS Exfiltration tools execution
References:
  -https://github.com/iagox86/dnscat2
  -https://github.com/yarrick/iodine
Author: Daniil Yugoslavskiy, oscd.community
Date: 2019-10-24
modified:2021-11-27
Tags:

• -'attack.exfiltration'
• -'attack.t1048.001'
• -'attack.command-and-control'
• -'attack.t1071.004'
• -'attack.t1132.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\iodine.exe' Image|contains:'\dnscat2'   condition:selection
Falsepositives:
  -Unlikely
Level: high