DNS tunneling
Named by 4 kept items in this workspace.
2 items name it under classification.key entities and 2 under techniques.
Search every workspace for DNS tunneling. It matches the name as written, so it can find other things that share it.
The items that name it 4
MILDFROST covert C2
Technique mentioned as used for exfiltration in the evolving attacker playbook.
All techniques in this workspace.