What is command and control over DNS?¶
The practical answer¶
Command and control over DNS uses domain-name queries and responses to carry instructions, identifiers or data.
The key evidential caution¶
The dangerous assumption is that unusual DNS activity automatically proves tunnelling or control.
It does not.
DNS is used constantly by legitimate software and can generate complex-looking queries.
Possible indicators include:
Key points¶
- long or encoded subdomains
- high query volume
- regular check-ins
- queries to unusual domains
- changing response values
- large numbers of unique names
- a process making unexpected DNS requests
Evidence to preserve¶
Investigators should preserve:
Key points¶
- full query names
- responses
- timestamps
- source device and process
- resolver used
- domain registration
- related network and endpoint activity
- decoded content where specialist analysis supports it
A DNS query may show an attempt to contact or exchange information.
It does not by itself prove that the server responded meaningfully or that commands were executed.
Legitimate security, tracking and cloud services may also use unusual DNS patterns.
Specialist interpretation may be required.
DNS-based control may be low-volume and blend with ordinary name resolution. Compare query length, frequency, uniqueness and process source with the normal pattern for that device. One unusual query is rarely enough to establish a control channel.
Where encoded labels are suspected, preserve the original queries before normalisation. Case, order and full subdomain content may matter during later technical analysis.
Resolver logs may also differ from endpoint observations, so preserve both where possible and explain any gap between query generation and upstream resolution.
Operational takeaway¶
Correlate unusual DNS patterns with the responsible process, domain context and resulting system behaviour before describing them as command-and-control traffic.