How Malware Uses DNS and How to Stop It
By [FILL IN], [FILL IN] · Last updated
Malware relies on DNS to find its command servers, exfiltrate data and download payloads. Learn the techniques and the DNS-level defenses.
Calling home
After infection, malware contacts a command-and-control (C2) server to receive instructions. It almost always finds that server through DNS.
Common techniques
Attackers use several tricks to keep DNS working for them.
- Domain generation algorithms (DGA) that create thousands of random domains
- Fast flux, rotating IP addresses behind a domain
- DNS tunneling, hiding data inside DNS queries
- Freshly registered domains that are not on any list yet
DNS defenses
Threat intelligence lists stop known C2 domains. New-domain blocking stops fresh ones. Unusual query volume to random-looking names points to DGA or tunneling and shows up in the query log.
Containment value
Even if a device gets infected, cutting off C2 communication often renders the malware harmless until it can be cleaned.