Technique Search Instance

HTTP 200 OK
Allow: GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 140,
    "key": "dns-tunneling",
    "unprotect_id": "U0905, T1048.003",
    "name": "DNS Tunneling",
    "description": "DNS tunneling is a technique that uses the Domain Name System (DNS) protocol to transfer data in an encrypted and covert manner. It involves encoding the data of other programs or protocols in DNS queries and responses, and using DNS servers as a means of communication.\r\n\r\nTo carry out DNS tunneling, the attacker typically needs access to a compromised system with external network connectivity and an internal DNS server with network access. The attacker also needs to control a domain and a server that can act as an authoritative DNS server in order to execute the server-side tunneling and data payload programs.\r\n\r\nDNS tunneling can be used for various purposes, such as to control remote servers and applications, transfer data, or bypass firewall restrictions. It can be difficult to detect, as the DNS protocol is commonly used for legitimate purposes and is typically not heavily scrutinized by security systems.",
    "resources": "https://securelist.com/use-of-dns-tunneling-for-cc-communications/78203/\nhttps://attack.mitre.org/techniques/T1048/003/",
    "creation_date": "2019-04-23T12:18:13Z",
    "tags": "DNS tunneling,\r\nDomain Name System (DNS),\r\nData transfer,\r\nEncrypted,\r\nCovert,\r\nExternal network connectivity,\r\nAuthoritative DNS server,\r\nServer-side tunneling,",
    "modification_date": "2023-10-04T10:45:00.526000Z",
    "category": [
        9,
        10
    ],
    "rules": [],
    "attachments": [],
    "featured_api": [],
    "contributors": []
}