DNS Server (T1583.002) is a sub-technique of Acquire Infrastructure in the resource development tactic. The adversary sets up their own Domain Name System servers to use in targeting. Platform: PRE.
How attackers use it
After compromise, adversaries can use DNS traffic for tasks such as command and control, for example through Application Layer Protocol (T1071). Instead of hijacking someone else's DNS servers, they may run their own.
MITRE explains the payoff: with their own server, adversaries control how server-side DNS C2 traffic is handled (DNS, T1071.004). They can set up DNS applications to give conditional responses to malware and have more flexibility in how the DNS-based C2 channel is built.
How to detect it
MITRE is direct: much of this activity happens outside the visibility of the target, so detection is hard. The advice is to focus on related stages, especially command and control.
What you can do inside your own network:
- Log DNS queries from all hosts at your resolver.
- Look for hosts that query unusual external names at high volume or at regular intervals.
- Block direct outbound DNS from endpoints to the internet, so all queries pass through the resolver you log.
How to reduce the risk
MITRE lists one mitigation, pre-compromise, and says this technique cannot easily be mitigated with preventive controls since it is behavior outside enterprise defenses. The controls above, resolver logging and outbound DNS restrictions, reduce what the adversary's server can do once malware tries to reach it.
Quick check
Why would an adversary run their own DNS server?
To control server-side DNS C2 traffic and give conditional responses to malware, with more flexibility in how the DNS-based channel is structured.
