We condensed this information (field Info) into this textual representation of DNS queries and replies: Figure 3: Textual representation of Cobalt Strike DNS traffic Seen in Wireshark, that DNS traffic looks like this: Figure 2: Wireshark view of Cobalt Strike DNS traffic We use a challenge from the 2021 edition of the Cyber Security Rumble to illustrate how Cobalt Strike DNS traffic looks like.įirst we need to take a look at the beacon configuration with tool 1768.py: Figure 1: configuration of a DNS beaconįield “payload type” confirms that this is a DNS beacon, and the field “server” tells us what domain is used for the DNS queries: walletthedarkestsideorg.Īnd then a third block of DNS configuration parameters is highlighted in figure 1: maxdns, DNS_idle, … We will explain them when they appear in the DNS traffic we are going to analyze. The data needs to be extracted from DNS queries, and then it can be decrypted (with the same cryptographic methods as for traffic over HTTP). Data flowing from the beacon to the team server is encoded with hexadecimal digits that make up labels of the queried name, and data flowing from the team server to the beacon is contained in the answers of A, AAAA and/or TXT records. A beacon can also be configured to communicate over DNS, by performing DNS requests for A, AAAA and/or TXT records. In the first 4 parts of this series, we have always looked at traffic over HTTP (or HTTPS). And in part 4, we deal with traffic obfuscated with malleable C2 data transforms. In part 3, we explain how to decrypt Cobalt Strike traffic if you don’t know the private RSA key but do have a process memory dump. In part 2, we decrypted Cobalt Strike traffic starting with a private RSA key. In part 1 of this series, we revealed private encryption keys found in rogue Cobalt Strike packages. This series of blog posts describes different methods to decrypt Cobalt Strike traffic. We show how to decode and decrypt DNS traffic in this blog post. This entry is part 5 in the series Cobalt Strike: Decrypting TrafficĬobalt Strike beacons can communicate over DNS.

Wireshark dns analysis