T1584.002 DNS Server
Sub-technique of T1584 Compromise Infrastructure
Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of…
Who uses it · with stories on Jábega
Sigma rules to hunt it
SigmaHQ has no rules for this technique.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.