Hunting in the dark: Detecting and disrupting DNS-based C2 traffic

Apart from the extensively exploited HTTP protocol, the DNS protocol plays a crucial role in network communication, capable of bypassing Layer-4 firewall restrictions commonly employed by many organizations. This presentation will delve into the misuse of DNS for establishing covert tunnels, and circumventing L4 firewalls. We will explore several tunneling tools and Command and Control (C2) frameworks, uncovering how threat actors leverage DNS for unauthorized network access. Our analysis reveals persistent DNS abuse as an effective attack vector employed by malicious entities over an extended period. The session will conclude with practical strategies to fortify DNS security, providing concrete steps to mitigate potential threats.