value:  Cobalt Strike can use a custom command and control protocol that can encapsulated in DNS. All protocols use their standard assigned ports. ;; Cobian RAT uses DNS for C2. ;; Denis has used DNS tunneling for C2 communications. ;; Ebury has used DNS requests over UDP port 53 for C2. ;; FIN7 has performed C2 using DNS via A OPT and TXT records. ;; Goopy has the ability to communicate with its C2 over DNS. ;; Helminth can use DNS for C2. ;; HTTPBrowser has used DNS for command and control. ;; InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies. ;; Ke3chang malware RoyalDNS has used DNS for C2. ;; Matryoshka uses DNS for C2. ;; NanHaiShu uses DNS for the C2 communications. ;; OilRig has used DNS for C2. ;; Pisloader uses DNS as its C2 protocol. ;; PlugX can be configured to use DNS for command and control. ;; POWERSOURCE uses DNS TXT records for C2. ;; POWRUNER can use DNS for C2 communications. ;; QUADAGENT uses DNS for C2 communications. ;; RDAT has used DNS to communicate with the C2. ;; Remsec is capable of using DNS for C2. ;; ShadowPad has used DNS tunneling for C2 communications. ;; SOUNDBITE communicates via DNS for C2. ;; SUNBURST used DNS for C2 traffic designed to mimic normal SolarWinds API communications. ;; TEXTMATE uses DNS TXT records for C2. ;; Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol. ;; WellMess has the ability to use DNS tunneling for C2 communications.
name: Application Layer Protocol: Dns