DnsSystem

Malware & Tools · DnsSystem

· MalwareS1021 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

DnsSystem is a .NET based DNS backdoor, which is a customized version of the open source tool DIG.net, that has been used by HEXANE since at least June 2022.(Citation: Zscaler Lyceum DnsSystem June 2022)

Tactic Coverage

command and control (3)execution (2)collection (1)discovery (1)exfiltration (1)persistence (1)privilege escalation (1)

Used By (1 groups)

G1001HEXANELyceum, Siamesekitten

Techniques (9)

T1005Data from Local System

collection

T1033System Owner/User Discovery

discovery

T1041Exfiltration Over C2 Channel

exfiltration

T1059.003Windows Command Shell

execution

T1071.004DNS

command and control

T1105Ingress Tool Transfer

command and control

T1132.001Standard Encoding

References

https://attack.mitre.org/software/S1021 https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor