DNS Exfiltration and Tunneling Tools Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•46

This rule detects the execution of well-known DNS exfiltration and tunneling tools, specifically 'iodine.exe' and 'dnscat2'. These tools are commonly used by adversaries to establish covert communication channels over DNS, allowing for data exfiltration and command and control activities that might bypass traditional network defenses.