---
title: Deprecated - Potential DNS Tunneling via Iodine
description: Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over the DNS protocol to circumvent firewalls, network security groups, and...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/_deprecated/command_and_control_linux_iodine_activity
products:
  - Elastic Security
---

# Deprecated - Potential DNS Tunneling via Iodine
<warning>
  This rule has been deprecated as of 2023/09/25.
</warning>

Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over the DNS protocol to circumvent firewalls,
network security groups, and network access lists while evading detection.
**Rule type**: query
**Rule indices**:
- auditbeat-*
- logs-endpoint.events.*
- endgame-*

**Rule Severity**: high
**Risk Score**: 73
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://code.kryo.se/iodine/](https://code.kryo.se/iodine/)](https://code.kryo.se/iodine/)

**Tags**:
- Domain: Endpoint
- OS: Linux
- Use Case: Threat Detection
- Tactic: Command and Control
- Data Source: Elastic Endgame
- Data Source: Elastic Defend

**Version**: 105
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide

This rule was deprecated due to its addition to the umbrella `Potential Linux Tunneling and/or Port Forwarding` (6ee947e9-de7e-4281-a55d-09289bdf947e) rule.

## Rule Query

```kuery
event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:(iodine or iodined)
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Command and Control
  - Id: TA0011
  - Reference URL: [[https://attack.mitre.org/tactics/TA0011/](https://attack.mitre.org/tactics/TA0011/)](https://attack.mitre.org/tactics/TA0011/)
- Technique:
  - Name: Protocol Tunneling
  - Id: T1572
  - Reference URL: [[https://attack.mitre.org/techniques/T1572/](https://attack.mitre.org/techniques/T1572/)](https://attack.mitre.org/techniques/T1572/)