new: Potential DNScat2 DNS Tunneling

Author: 6ixxclixx

rules/network/dns/net_dns_mal_dnscat2_tunneling.yml

@@ -0,0 +1,32 @@
+title: Potential DNScat2 DNS Tunneling
+id: 8d28e7ad-d532-4a59-a181-bcea4afbffcc
+status: test
+description: |
+    Detects DNS queries generated by the dnscat2 tunneling tool when it is run
+    without a dedicated authoritative domain ("direct" connection mode). In this
+    mode the client prefixes every request with the static label "dnscat."
+    followed by hex-encoded command-and-control data, which is a high-signal
+    artifact rarely seen in legitimate DNS traffic.
+    This complements the existing process-creation detection (which requires the
+    tool binary to run on a monitored Windows endpoint) by catching the tunnel
+    on the wire from any host, including Linux, IoT, and unmanaged devices.
+references:
+    - https://github.com/iagox86/dnscat2
+    - https://www.activecountermeasures.com/malware-of-the-day-dnscat2-dns-tunneling/
+author: Shae Mark
+date: 2026-07-07
+tags:
+    - attack.exfiltration
+    - attack.t1048.001
+    - attack.command-and-control
+    - attack.t1071.004
+    - attack.t1132.001
+logsource:
+    category: dns
+detection:
+    selection:
+        query|startswith: 'dnscat.'
+    condition: selection
+falsepositives:
+    - Legitimate hostnames that begin with the label "dnscat" (very rare)
+level: high