macOS DNS Query Tools for C2

Status: experimental
Severity: medium
Log source: product macos, service endpointsecurity
Author: Eric Brown - Nebulock, Inc.
Source: github.com/Nebulock-Inc/macos-coresigma

Detects execution of DNS query tools (dig, nslookup, host, dnscat2) which may indicate DNS tunneling for command and control communication. Adversaries use DNS queries to exfiltrate data or receive commands while evading network controls.

Known false positives

Network troubleshooting and DNS diagnostics
Automated monitoring scripts checking DNS resolution
System administration tasks

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1071.004` Application Layer Protocol: DNS `T1568` Dynamic Resolution

Rule body

title: macOS DNS Query Tools for C2
id: 06b33424-75d1-4993-b57f-eca4580b408a
status: experimental
description: 'Detects execution of DNS query tools (dig, nslookup, host, dnscat2)
  which may

  indicate DNS tunneling for command and control communication. Adversaries use

  DNS queries to exfiltrate data or receive commands while evading network controls.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1071/004/
- https://attack.mitre.org/techniques/T1568/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_event:
    esf.event_type: 9
    event.action: exec
  selection_process:
    Image|endswith:
    - /dig
    - /nslookup
    - /host
    - /dnscat
    - /dnscat2
  condition: selection_event and selection_process
falsepositives:
- Network troubleshooting and DNS diagnostics
- Automated monitoring scripts checking DNS resolution
- System administration tasks
fields:
- Image
- CommandLine
- ProcessId
- ParentProcessId
- User
tags:
- attack.command_and_control
- attack.t1071.004
- attack.t1568
level: medium

Stages and Predicates

Stage 0: `condition`

selection_event and selection_process

Stage 1: `selection_event`

selection_event:
  esf.event_type: 9
  event.action: exec

Stage 2: `selection_process`

selection_process:
  Image|endswith:
  - /dig
  - /nslookup
  - /host
  - /dnscat
  - /dnscat2

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`/dig` `/dnscat` `/dnscat2` `/host` `/nslookup`	`field:"Image" kind:ends_with`
`esf.event_type`	eq	`9`	`field:"esf.event_type" kind:eq value:"9"`
`event.action`	eq	`exec`	`field:"EventType" kind:eq value:"exec"`