Windows DNS Exfiltration Tool Execution via iodine.exe or dnscat2

title: Windows DNS Exfiltration Tool Execution via iodine.exe or dnscat2
id: 09de98d0-ef4a-4796-a921-3dec75bc7c61
status: test
description: This rule matches process creation events where the executable image path ends with iodine.exe or contains dnscat2. Attackers may use these DNS-based tools to exfiltrate data or establish covert command-and-control over DNS traffic. The detection relies on Windows process creation telemetry, specifically the Image field content in the spawned process command path.
references:
  - https://github.com/iagox86/dnscat2
  - https://github.com/yarrick/iodine
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dns_exfiltration_tools_execution.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2019-10-24
modified: 2021-11-27
tags:
  - attack.exfiltration
  - attack.t1048.001
  - attack.command-and-control
  - attack.t1071.004
  - attack.t1132.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \iodine.exe
    - Image|contains: \dnscat2
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 98a96a5a-64a0-4c42-92c5-489da3866cb0
    type: derived