virus logo Intrusion Prevention

Dnscat2.DNS.Tunnel

description-logoDescription

This indicates an attempt to use Dnscat2 DNS Tunnel.
Dnscat2 is a proxy tool that can tunnel data over DNS to bypass firewall policy. Some malware and APT attacks have used Dnscat2 to communicate with C&C servers.

affected-products-logoAffected Products

All systems

Impact logoImpact

System Compromise: Remote attackers can gain control of vulnerable systems.

recomended-action-logoRecommended Actions

Monitor the traffic from the network for any suspicious activity.

Coverage

IPS (Regular DB)
IPS (Extended DB)

Version Updates

Date Version Status Detail
2019-12-10 15.741
Modified
 Default_action:pass:drop
2019-10-16 14.705
Modified
 Sig Added
2019-09-24 14.693
Modified
 Sig Added
2019-09-20 14.692
New

References

https://github.com/iagox86/dnscat2/blob/master/doc/protocol.md
ID 48370
Created Oct 10, 2019
Updated May 02, 2022
Risk black-background-circle-icon black-background-circle-icon lightgray-background-circle-icon lightgray-background-circle-icon lightgray-background-circle-icon
Default Action drop
Active
Affected OS Windows, Linux, BSD, Solaris, MacOS, All
Affected App Other
Profile Type Anomaly