MITRE ATT&CK, mapped only where the evidence allows
The observatory carries the subset of ATT&CK that DNS telemetry can genuinely speak to. Each technique states MITRE's own framing, our interpretation of its DNS relevance, and the exact rule that decides whether a live observation is attached to it. Where a technique needs telemetry we do not hold — tunnelling, DGA, fast flux — we say so instead of guessing.
Resource Development
2 DNS-relevant techniques
Initial Access
1 DNS-relevant techniques
Command and Control
8 DNS-relevant techniques
T1071.004
Application Layer Protocol: DNS
Adversaries may communicate using the DNS application layer protocol to avoid detection and network filtering by blending in with existing traffic.
Where command-and-control infrastructure is reached through a domain name, DNS resolution is part of the control path. That makes resolver telemetry a primary detection surface — but it does not on its own prove the channel itself is DNS-encoded.
Applied only where a source reports command-and-control activity AND the indicator is reachable via a domain name, so DNS resolution is genuinely part of the control path.
relationship · contextual · supported by · command-and-control, botnet
- Log and retain all client DNS queries with the querying host identity.
- Alert on resolution of newly registered or rarely queried domains.
- Look for beaconing regularity in query intervals to a single name.
- Compare resolver logs against known C2 indicator sets.
Framework references are contextual alignment. They do not imply MITRE endorsement, certification, or an assessed control posture.