Plan
active
Unit 42: ~50% of C2 Malware Bypasses DNS via Direct-IP Connections
- Engineer — Plan: Audit egress firewall rules to block or alert on outbound connections to raw IPs (not resolved via internal DNS); this is a concrete hardening step supported by the finding.
- SOC/IR — Plan: Build or tune detections for outbound traffic to bare IP addresses without preceding DNS resolution — this pattern is a high-signal C2 indicator worth adding to your SIEM hunting queries.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.