Skip to content
Attack Paths
← RegistryDossier · 5 steps · 4 edges

DNS tunnel exfiltration in restricted egress

Outbound web is filtered, but DNS still resolves to the corporate forwarder. Use iodine / dnscat2 to tunnel a shell + exfil over DNS queries to an attacker-controlled authoritative server.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: foothold on a tightly-firewalled internal host. Only egress allowed is recursive DNS. Attacker controls a public domain and runs iodine / dnscat2 server.

§ Steps

  1. 01
    Exfil sensitive data byte-by-byteExfiltration
    T1041— Exfiltration Over C2 Channel
  2. 02
    Foothold on host with no internetInitial Access
    T1078— Valid Accounts
  3. 03
    Confirm DNS resolves attacker domainDiscovery
    T1018— Remote System Discovery
  4. 04
    Start dnscat2 / iodine clientExfiltration
    DNS-TUNNEL-EXFIL— DNS Tunneling Exfil (iodine / dnscat2)
  5. 05
    C2 channel over DNSCommand and Control
    DNS-DOH-C2— DNS-over-HTTPS C2 Channel

§ References

§ Frequently asked

What is the "DNS tunnel exfiltration in restricted egress" attack path?
Outbound web is filtered, but DNS still resolves to the corporate forwarder. Use iodine / dnscat2 to tunnel a shell + exfil over DNS queries to an attacker-controlled authoritative server. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Exfil sensitive data byte-by-byte (T1041) — a exfiltration primitive. Assumed environment: foothold on a tightly-firewalled internal host.
What is the final impact of this kill-chain?
The final step lands on C2 channel over DNS (DNS-DOH-C2), which falls under Command and Control. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers