📡 C2 Sinkhole / DNS

Deceptive DNS resolvers routing malware to internal sandboxes.

→ Explore in ATT&CK matrix (12 mappings) Deployment detail

What it is

An internal DNS resolver that answers lookups for known malicious domains with the address of a sinkhole you run. Infected hosts look up their command servers, so the lookup and the connection to the sinkhole reveal which internal host is infected. It only works for domains already known to be malicious.

Implementation requirements

On internal resolvers, answer queries for known malicious domains with the address of a sinkhole you run: Response Policy Zones (RPZ) on BIND or Unbound, Windows DNS policies, or Route 53 Resolver DNS Firewall with an OVERRIDE action (it returns a custom CNAME)
The sinkhole host logs every connection. Any internal host connecting to it is likely infected, and the DNS query log shows which host asked first
Feed it only from vetted threat intelligence, with an owner and review date for every entry. Sinkholing a legitimate domain breaks the business
Safety: the sinkhole accepts connections and records them, and never sends commands back. It is internal and does not act on attacker infrastructure. OPSEC: it does not reveal itself in its responses
Rollback: Remove the RPZ or firewall entries. Shut down the sinkhole host.
Upkeep: Review every entry on its review date; expire entries without an owner. Monthly proof-of-life lookup of a test domain.

Technologies

NetworkAWSWindows

ATT&CK coverage 12

Technique	Tactic	Status	Confidence	Tier
T1008 Fallback Channels	Command & Control	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1008 Fallback Channels as an adversary behaviour. A sinkhole only sees fallback domains already known.
↳ Sinkhole sees the traffic, but the underlying D052 evidence base is weak.
T1071 Application Layer Protocol	Command & Control	theoretical	weak	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1071 Application Layer Protocol as an adversary behaviour. Sinkholes catch callbacks only to already-known C2 domains.
T1071.001 Web Protocols	Command & Control	theoretical	weak	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1071.001 Web Protocols as an adversary behaviour. Sinkholes see only known C2 domains.
T1071.004 DNS	Command & Control	theoretical	weak	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1071.004 DNS as an adversary behaviour. Sinkholes see only known C2 domains.
T1090 Proxy	Command & Control	theoretical	weak	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1090 Proxy as an adversary behaviour. Proxied C2 runs through attacker infrastructure.
T1090.003 Multi-hop Proxy	Command & Control	theoretical	weak	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1090.003 Multi-hop Proxy as an adversary behaviour. Proxy chains run through attacker infrastructure.
T1095 Non-Application Layer Protocol	Command & Control	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1095 Non-Application Layer Protocol as an adversary behaviour. The attacker's own C2 never reaches a tarpit unless they are already inside a honey network.
T1104 Multi-Stage Channels	Command & Control	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1104 Multi-Stage Channels as an adversary behaviour. Multi-stage C2 runs to attacker infrastructure.
↳ Reasonable mechanism, weak underlying evidence.
T1568 Dynamic Resolution	Command & Control	theoretical	weak	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1568 Dynamic Resolution as an adversary behaviour. Dynamic resolution only reaches a sinkhole for known domains.
T1568.002 Domain Generation Algorithms	Command & Control	theoretical	weak	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1568.002 Domain Generation Algorithms as an adversary behaviour. DGA domains reach a sinkhole only once known.
T1572 Protocol Tunneling	Command & Control	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1572 Protocol Tunneling as an adversary behaviour. Tunnels run to the attacker's own server; only known-bad DNS names reach a sinkhole.
T1041 Exfiltration Over C2 Channel	Exfiltration	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1041 Exfiltration Over C2 Channel as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1041 to its Lures activity. The data maze sees bulk collection, not the C2 channel.
↳ Tarpit research extrapolated to C2 exfiltration; unvalidated in this context.

Evidence

Decoy Network Resource (D3-DNR) — MITRE D3FEND standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
SoK: P2PWNED — Modeling and Evaluating the Resilience of Peer-to-Peer Botnets — Rossow, C. et al., IEEE S&P 2013 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard