What to actually do about it
Visibility without action is decoration. Each playbook takes one behaviour and walks it through five stages, then states plainly what the underlying report does and does not prove — because acting on the wrong assumption causes its own outage.
Command & Control
Adversaries use DNS infrastructure to locate or communicate with malicious systems. If resolution fails, the control channel often fails with it.
- Use protective DNS filtering for all client egress.
- Restrict clients to approved resolvers and block direct outbound port 53/853.
- Block or heavily inspect DNS-over-HTTPS to unapproved providers.
- Log DNS queries with the querying host identity, and retain them.
- Alert on resolution of newly registered or rarely queried domains.
- Look for regular beaconing intervals to a single name.
- Match resolver logs against C2 indicator feeds continuously, not once.
- Identify every internal client that queried the indicator.
- Pull EDR process context for the querying process, not just the host.
- Correlate with proxy, firewall and authentication telemetry.
- Check whether the address is shared hosting before widening scope.
- Block validated malicious names at the resolver.
- Isolate affected endpoints where impact justifies it.
- Avoid indiscriminate IP blocking on shared infrastructure.
- Confirm the channel is dead by monitoring for retry attempts.
- Remove temporary blocks that are no longer justified.
- Feed what you learned back into detection content.
NIST CSF alignment
Contextual mapping only
- PR.IRProtect · Infrastructure resilience
Resolver control and egress restriction limit reachable control paths.
- DE.CMDetect · Continuous monitoring
DNS query logging and intelligence matching surface control activity.
- RS.MIRespond · Mitigation
Name-level blocking contains activity without collateral damage.
Read this before you block
A C2 report tells you infrastructure was seen serving control traffic. It does not tell you whether your environment ever contacted it.
Related ATT&CK
The five functions
How DNS work lands across the NIST Cybersecurity Framework
Roles, policy and risk decisions around DNS and threat intelligence.
Know which resolvers, zones and registrars you depend on.
Protective DNS, resolver control, account hardening.
Query logging, anomaly detection, intelligence matching.
Blocking, containment and proportionate action.
Restoring resolution integrity and reviewing what worked.
Guidance is advisory. Framework references indicate alignment of intent, not certification or an assessed control posture.