Windows Execution of dnscat2 and iodine DNS Exfiltration/Tunneling Tools

Flags Windows execution of DNS tunneling/exfiltration tools identified by iodine.exe or dnscat2 in process creation events.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
Published: 2019-10-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

C2 → Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.004DNS
- T1132.001Standard Encoding
Exfiltration
- T1048.001Exfiltration Over Symmetric Encrypted Non-C2 Protocol
Impact

What it detects

This rule identifies process executions on Windows where the binary path ends with iodine.exe or contains dnscat2. These tools are commonly associated with DNS-based exfiltration or tunneling, which can help attackers bypass conventional network controls. The detection relies on process creation telemetry, matching on the executed image filename/path.

Reporting behind it

Related detections9 linkedT1071.004 — drag to rearrange

Malicious Project CAV3RN DNS Configuration Recovery via cloudlanecdn.com (via dns_query)

Suspicious Long Alphanumeric DNS Subdomain Indicative of DNS Tunneling

Suspicious DNS Tunneling With Hex Subdomain To info Domain (via dns_query)

Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)

Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs

Suspicious UPSTYLE Command Channel Pattern in Web Requests via CVE-2024-3400

Suspicious DNS C2 to Microsoft Typosquat Domain

Suspicious DNS Queries to Simitor Tracking Tunnel Infrastructure

Suspicious DNS Queries to Secshow Open Resolver Scanning Infrastructure

Windows Execution of dnscat2 and iodine DNS Exfiltration/Tunneling Tools

Pivot detection · T1071.004 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dns-exfiltration-tool-execution-via-iodine-exe-or-dnscat2-98a96a5a

title: Windows Execution of dnscat2 and iodine DNS Exfiltration/Tunneling Tools
id: 09de98d0-ef4a-4796-a921-3dec75bc7c61
status: test
description: This rule identifies process executions on Windows where the binary path ends with iodine.exe or contains dnscat2. These tools are commonly associated with DNS-based exfiltration or tunneling, which can help attackers bypass conventional network controls. The detection relies on process creation telemetry, matching on the executed image filename/path.
references:
  - https://github.com/iagox86/dnscat2
  - https://github.com/yarrick/iodine
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_dns_exfiltration_tools_execution.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2019-10-24
modified: 2021-11-27
tags:
  - attack.exfiltration
  - attack.t1048.001
  - attack.command-and-control
  - attack.t1071.004
  - attack.t1132.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \iodine.exe
    - Image|contains: \dnscat2
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 98a96a5a-64a0-4c42-92c5-489da3866cb0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL