Cavern (Cav3rn) C2: Detecting DNS Tunneling and Google Apps Script Abuse by Iranian APT Operators

---
title: Non-Browser Process Network Connection to Google Apps Script
id: 3f8a1c42-7b9d-4e5a-a1c6-9d2e4f7b8a01
status: experimental
description: Detects non-browser processes establishing network connections to Google Apps Script infrastructure (script.google.com / script.googleusercontent.com), consistent with Cavern C2 abusing Apps Script as a C2 relay. Legitimate Apps Script traffic originates from browsers; connections from scripting hosts, LOLBins, or unsigned binaries are highly suspicious.
references:
  - https://thehackernews.com/2026/08/cavern-c2-uses-dns-and-google-apps.html
  - https://attack.mitre.org/techniques/T1102/
  - https://attack.mitre.org/techniques/T1090/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1090
logsource:
  category: network_connection
  product: windows
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'script.google.com'
      - 'script.googleusercontent.com'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
      - '\iexplore.exe'
  filter_google_update:
    Image|endswith:
      - '\GoogleUpdate.exe'
  condition: selection_domain and not 1 of filter_*
falsepositives:
  - Legitimate Google Workspace automation tools or CLI utilities interacting with Apps Script deployments
  - Enterprise RMM or IT automation platforms calling internal Apps Script web apps
level: high
---
title: Suspicious DNS Query Characteristics Indicative of DNS Tunneling
id: 8c2e5d91-4a6f-4b38-9c1d-2e7f5a8b3c04
status: experimental
description: Detects DNS TXT or NULL record queries with abnormally long query names, consistent with DNS tunneling C2 channels such as those used by the Cavern framework. Tunneling implants encode command output into subdomain labels, producing query names far longer than typical legitimate traffic.
references:
  - https://thehackernews.com/2026/08/cavern-c2-uses-dns-and-google-apps.html
  - https://attack.mitre.org/techniques/T1071/004/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.command_and_control
  - attack.t1071.004
  - attack.exfiltration
  - attack.t1048
logsource:
  category: dns
  product: windows
detection:
  selection_type:
    record_type:
      - 'TXT'
      - 'NULL'
      - 'CNAME'
  selection_length:
    query|re: '.{100,}'
  filter_common:
    query|contains:
      - 'google.com'
      - 'microsoft.com'
      - 'apple.com'
      - 'amazondns.com'
  condition: selection_type and selection_length and not filter_common
falsepositives:
  - DKIM/SPF TXT lookups against unusually deep domain structures
  - Some email security gateways performing long verification queries
level: medium

// Hunt: Non-browser / LOLBin processes communicating with Google Apps Script infrastructure
// Correlates process lineage with network destination — the key pivot for Cavern-style C2
let GoogleAppsScript = dynamic(["script.google.com", "script.googleusercontent.com"]);
let Browsers = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "iexplore.exe", "GoogleUpdate.exe"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl in (GoogleAppsScript)
| where not(InitiatingProcessFileName in~ (Browsers))
| extend SuspiciousLineage = iff(InitiatingProcessFileName in~ (
    dynamic(["powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe",
             "rundll32.exe","regsvr32.exe","wmic.exe","cmd.exe","curl.exe","bitsadmin.exe"])),
    "LOLBin", "OtherNonBrowser")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessParentFileName, SuspiciousLineage, RemoteUrl, RemoteIP, RemotePort,
          InitiatingProcessSHA256, ReportId
| sort by TimeGenerated desc;

// Hunt: DNS tunneling indicators — long TXT/CNAME queries and high query volume per host-domain pair
// Requires DNS events ingested (ASimDnsActivityLogs, or DNS Events via connector)
DeviceEvents
| where TimeGenerated > ago(7d)
| where ActionType == "DnsQueryResponse"
| extend QueryName = tostring(AdditionalFields.QueryName)
| extend QueryType = tostring(AdditionalFields.QueryType)
| where QueryType in~ ("TXT", "NULL", "CNAME")
| extend QueryLength = strlen(QueryName)
| where QueryLength > 100
| summarize QueryCount = count(), MaxLength = max(QueryLength), ExampleQuery = any(QueryName)
    by DeviceName, QueryType, bin(TimeGenerated, 1h)
| where QueryCount > 20 or MaxLength > 180
| sort by QueryCount desc;

-- Hunt: Identify processes holding active connections to Google Apps Script infrastructure
-- and suspicious DNS resolver behavior. Run across the fleet as a Velociraptor hunt.
SELECT Pid, Name, Path, CommandLine, Username,
       netstat().RemoteIP AS RemoteIP,
       netstat().RemotePort AS RemotePort,
       netstat().Status AS ConnStatus
FROM pslist()
WHERE netstat().RemotePort = 443
  AND NOT Name =~ '(?i)(chrome|msedge|firefox|brave|opera|iexplore|GoogleUpdate)'
  AND CommandLine =~ '(?i)(apps.?script|google)'

-- Companion: enumerate DNS client cache for script.google entries resolved by non-browser tooling
SELECT Name, Data, Type
FROM glob(glob='C:/Windows/System32/drivers/etc/hosts')

# Cavern C2 Exposure Audit - Run elevated on endpoints or via GPO/SCCM

# 1. Check for active/historical connections to Google Apps Script from non-browser processes
Write-Host "=== Active TCP 443 connections from non-browser processes ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -RemotePort 443 -ErrorAction SilentlyContinue |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc -and $proc.ProcessName -notmatch '^(chrome|msedge|firefox|brave|opera|iexplore)$') {
            [PSCustomObject]@{
                Process     = $proc.ProcessName
                Path        = $proc.Path
                RemoteIP    = $_.RemoteAddress
                PID         = $_.OwningProcess
            }
        }
    } | Format-Table -AutoSize

# 2. Verify outbound DNS is restricted to approved resolvers (check local firewall policy)
Write-Host "=== Outbound DNS (53) firewall rules ===" -ForegroundColor Cyan
Get-NetFirewallRule -Direction Outbound -ErrorAction SilentlyContinue |
    Where-Object { $_.Enabled -eq 'True' } |
    Get-NetFirewallPortFilter -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 53, 853 -or $_.LocalPort -in 53, 853 } |
    Select-Object DisplayName, Action, Profile

# 3. Enable DNS Client operational logging for hunt telemetry
$log = Get-WinEvent -ListLog "Microsoft-Windows-DNS-Client/Operational"
if (-not $log.IsEnabled) {
    $log.IsEnabled = $true
    $log.SaveChanges()
    Write-Host "[+] DNS Client Operational log enabled" -ForegroundColor Green
} else {
    Write-Host "[i] DNS Client Operational log already enabled" -ForegroundColor Yellow
}

# 4. Flag hosts resolving script.google.com recently (last 24h)
Write-Host "=== Recent DNS resolutions of Apps Script domains ===" -ForegroundColor Cyan
Get-WinEvent -LogName "Microsoft-Windows-DNS-Client/Operational" -MaxEvents 5000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'script\.google|googleusercontent' -and $_.TimeCreated -gt (Get-Date).AddDays(-1) } |
    Select-Object TimeCreated, Message -First 20 | Format-List