BIOC
High
✕
Possible C2 via dnscat2
Dnscat2 creates an encrypted C2 channel over the DNS protocol, which attackers may use to hide traffic.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Command and Scripting Interpreter (T1059)
Indicator:
Process action type = execution AND target process name = dnscat2 Host host os = linux
Preventable: yes