Fileless Malware DNS Queries: How It Works

Yes, fileless malware can and does use DNS queries to operate. DNS is a fundamental internet protocol that is rarely blocked by firewalls, making it an attractive channel for attackers to communicate with command-and-control (C2) servers, exfiltrate data, and even deliver malicious payloads entirely in memory.

What Is Fileless Malware?

Fileless malware is a category of malicious software that does not rely on writing a traditional executable file to the disk. Instead, it operates in memory, often using legitimate system tools like PowerShell, WMI, or the Windows registry to execute its code. Because there is no file to scan, traditional antivirus software that relies on signature-based detection often misses it. The term “fileless” is somewhat misleading—many variants do use files temporarily, but the core characteristic is that the primary malicious activity happens in memory, leaving little forensic evidence on the hard drive.

How DNS Fits Into Fileless Attacks

DNS (Domain Name System) is the internet’s phonebook, translating human-readable domain names into IP addresses. Every device on a network uses DNS constantly, so security teams rarely block it entirely. Attackers exploit this by embedding malicious commands or stolen data within DNS queries and responses. Because DNS traffic is often allowed through firewalls and is not deeply inspected, it provides a covert channel for communication.

In a fileless attack, DNS can be used in several ways:

• Command and Control (C2): The malware sends DNS queries to a domain controlled by the attacker. The response, encoded in the DNS answer, contains commands for the malware to execute.
• Data Exfiltration: Sensitive data is broken into small chunks and encoded into DNS queries sent to the attacker’s domain. Each query looks like a normal DNS request, but the subdomain contains stolen data.
• Payload Delivery: Some fileless malware uses DNS TXT records to download malicious scripts or binaries. The malware queries a specific domain, receives a TXT record containing the payload, and executes it directly in memory.

DNS Tunneling: The Core Technique

DNS tunneling is the most common method for fileless malware to use DNS. It works by encoding data into the domain name itself. For example, a query like exfiltrated-data.attacker.com carries the stolen information in the subdomain portion. The attacker’s DNS server logs these queries, extracts the data, and can send responses back with commands embedded in DNS records.

This technique is effective because DNS queries are ubiquitous and often not monitored for content. Firewalls typically allow DNS traffic to any server, and even when they restrict it to a specific DNS resolver, the malware can still send queries directly to the attacker’s domain if outbound UDP port 53 is open.

Real-World Examples of DNS-Based Fileless Malware

Several well-known malware families have used DNS as a communication channel. The DNSMessenger attack (2017) used DNS TXT records to deliver PowerShell commands to compromised systems. The malware queried a legitimate domain that the attacker controlled, received a TXT record with a base64-encoded script, and executed it in memory. Similarly, the ISFB (also known as Gozi) banking trojan used DNS tunneling for C2 communication in its fileless variants. These examples demonstrate that DNS-based fileless attacks are not just theoretical—they have been observed in the wild and continue to evolve.

Why DNS Is Hard to Defend Against

Defending against DNS-based fileless malware is challenging for several reasons:

• Legitimate use: DNS is essential for internet connectivity, so you cannot simply block it.
• Encrypted DNS: DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt DNS traffic, making it harder for security tools to inspect.
• Low volume: DNS queries are small, so exfiltrating large amounts of data takes time, but attackers can be patient.
• Lack of visibility: Many organizations do not log or analyze DNS traffic, so malicious queries go unnoticed.

How to Detect and Mitigate DNS-Based Fileless Attacks

Detection requires a combination of network monitoring and endpoint security:

1. Monitor DNS logs: Look for anomalies such as long subdomains, high volumes of queries to a single domain, or domains that are recently registered.
2. Use threat intelligence: Block known malicious domains and IPs using feeds from security vendors.
3. Enable DNS logging on your resolver: If you use a corporate DNS server, ensure it logs all queries and review them regularly.
4. Deploy endpoint detection and response (EDR): EDR tools can detect suspicious PowerShell or WMI activity even if no file is written.
5. Restrict outbound DNS: Force all DNS traffic through a controlled resolver and block direct queries to external DNS servers.
6. Use behavioral analysis: Machine learning can identify unusual DNS patterns that indicate tunneling.

Frequently Asked Questions

Can DNS queries alone execute fileless malware?

No. DNS queries are just a communication channel. The malware still needs a way to execute code on the target machine, typically through a vulnerability or a legitimate tool like PowerShell. DNS is used for delivering commands and exfiltrating data, not for the initial infection.

Does DNS tunneling always indicate malware?

Not always. Some legitimate applications and services use DNS tunneling for data transfer, such as VPN solutions that work over DNS when other ports are blocked. However, in an enterprise environment, unexpected DNS tunneling is suspicious and should be investigated.

Can antivirus detect fileless malware that uses DNS?

Traditional antivirus that relies on file signatures will not detect fileless malware because there is no file to scan. However, modern antivirus and EDR solutions use behavioral detection and can flag unusual DNS activity or in-memory code execution.

Is DNS-over-HTTPS making fileless malware worse?

DNS-over-HTTPS (DoH) encrypts DNS queries, which can hide malicious DNS traffic from network security tools. This makes detection harder, but DoH also provides privacy benefits. Organizations can block DoH to force DNS traffic through their own monitoring, though this can break some user privacy.

How can I check if my network is being used for DNS tunneling?

Look for DNS queries with very long subdomains (over 50 characters), a high frequency of queries to a single domain, or domains that are not in your normal browsing patterns. Use tools like Wireshark to capture DNS traffic and analyze it for anomalies.

What should I do if I suspect DNS-based fileless malware?

Immediately isolate the affected system from the network, preserve logs, and run a full security audit. Contact your incident response team or a professional cybersecurity firm. Do not attempt to clean the system yourself if you lack experience, as you may destroy evidence.

Related

• Dewalt Adapter as Power Bank: Does It Work?
• Python Arcade Power Ups & Collectibles: How to Create
• Power Tools as Phone Battery Banks? Truth